TrustLoop

TrustLoop is a runtime guard layer that sits between AI agents and the external systems they interact with. It intercepts proposed actions, evaluates them against policies, and returns explicit decisions before execution occurs. The decisions include permit, deny, transform, require approval, or defer, each accompanied by reasoning that explains why the action was allowed or blocked. This is not another prompting technique or fine-tuning approach. It is a hard boundary at the execution layer where every side effect passes through a checkpoint before reaching users, tools, or payment systems.

The problem it addresses is consequential and growing. Production AI agents can shell out commands, send emails, trigger payments, call APIs, and interact with external services. Without a hard boundary, a single bad output can send the wrong email to the wrong person, burn through an API budget in minutes, execute a dangerous system command, or authorize a payment that should have been blocked. Prompt-based guardrails help, but they live inside the same context window the agent controls. A clever prompt injection or a poorly scoped system message can bypass them. TrustLoop operates at a separate runtime boundary where policies are evaluated on proposed actions, not on the agent's reasoning about what it might do. The check happens after the agent decides but before anything irreversible occurs.

Under the hood the system provides decision receipts, essentially audit trails that document what was proposed, what decision was made, and why the policy engine reached that conclusion. These receipts are cryptographically verifiable, which matters for compliance scenarios, post-incident reviews, and demonstrating to auditors that controls were in place. The policies themselves can be defined in durable context rather than relying on the transient state of a conversation. This means spending caps, command allowlists, communication rules, and approval thresholds persist across sessions and apply consistently regardless of how the agent reached its decision.

TrustLoop ships SDKs for TypeScript, Python, and Rust, so integrating it into an existing agent stack requires wrapping the action dispatch calls rather than rewriting the agent architecture. The pattern is straightforward. Before your agent executes an action, it sends the proposed action to TrustLoop. TrustLoop evaluates the proposal against your policies and returns a decision. If the decision is permit, the action proceeds. If the decision is deny or transform, the agent handles the result accordingly. If the decision is require approval, the system can route to a human reviewer before continuing. This model keeps the control layer separate from the intelligence layer, so upgrades to either do not break the other.

The Rust runtime is self-hostable, meaning teams can deploy it within their own infrastructure if data residency or latency is a concern. There is no requirement to send action proposals to a third-party service if that does not fit your security posture. You run the service, you own the logs, and you control the policy definitions.

The target audience is development teams running AI agents in production who need guardrails against uncontrolled spending, dangerous shell commands, unauthorized outbound communication, or any action where a mistake is hard to reverse. It fits companies building agentic products for customers and internal teams automating workflows where a single runaway agent could cause real damage. If you have shipped an agent and spent time worrying about what happens when it does something unexpected, TrustLoop is designed for that exact concern.

Where it stands apart is the focus on a hard boundary rather than soft guidance. The product does not try to make the agent smarter or steer its reasoning. It catches the output at the moment of execution and applies policy checks there. That separation means the control layer is not competing with the prompt for attention. It also means the audit trail reflects actual execution decisions rather than internal chain-of-thought artifacts that might or might not match what happened.

TrustLoop is open source under the Apache 2.0 license. There is no signup required to start using it, and no card is needed. Teams can clone the repository, run the Rust service, and integrate the SDK into their agent pipeline immediately. The project also offers a live demo at app.gettrustloop.app for teams who want to test the behavior before integrating, and booking links are available for deeper conversations with the maintainers.