ActionRail: Open-source framework stops AI agents from executing wrong values

ActionRail is an open-source runtime value and action grounding framework developed by ToolJet. It solves a specific failure mode in AI agent execution: an agent's tool call can be perfectly permitted and syntactically well-formed but still wrong—for example, a refund on an order that was already refunded, a transfer to a real account that belongs to the wrong customer, or a withdrawal larger than the account balance. Standard allowlists and schema checks pass these cases because they only verify the shape of the request, not the correctness of the values against live data.

ActionRail intercepts consequential tool calls before execution and grounds each argument against your live system of record, then returns allow, hold-for-human, or block. The framework runs at the execution boundary: source lookups and credentials stay in the customer environment, and the tool is invoked only after an allow decision. Any Python application can use the framework-neutral ActionRuntime directly through explicit boundaries in code. LangGraph has automatic tool discovery and wrapping; additional framework adapters are planned.

The evidence for ActionRail's effectiveness comes from red-team testing across eight models from four providers using value-poisoning attacks—inputs designed to steer an agent toward well-formed but wrong argument values. Every unprotected model executed at least one poisoned value, with attack success ranging from 1.7% to 63.3%. With ActionRail in front, 0 of 480 manipulated actions executed and 0 of 480 legitimate look-alike requests were wrongly blocked. The decision pipeline runs cheapest-check-first and supports a two-tier approach: policy (deterministic expressions like "amount <= 200 → hold for human") and grounding (value versus system of record). Grounding is expressive, supporting multiple checks ANDed across different sources, each comparing a returned field with operators (=, ≠, >, ≥, <, ≤, contains, is one of, is set, is empty) against a caller-context value, a literal, another argument (e.g., balance ≥ amount), or the current time (e.g., delivered_at ≥ now-30d).

ActionRail supports sources that remain in your environment: SQLite, PostgreSQL, MySQL/MariaDB, HTTP/REST, and MCP gateway adapters. PostgreSQL and MySQL connections use read-only modes, named parameters, and enforced timeouts. Secrets are written as ${env:VAR} references and resolve locally, so credentials never reach the control plane. An optional Django control plane and React Console let teams register sources, author grounding rules per argument, and watch a live activity feed of every allow, hold, and block decision. The SDK reports only metadata—tool names, outcomes, value-free reasons, and redacted previews; detailed results and rendered previews are exposed only on the local decision, not to the model. ActionRail also introduces Action Tests: rules committed alongside executable contracts that run through the same decision pipeline used in production, enabling allow, hold, and block to become reviewable CI contracts without needing model API keys, credentials, or network access. The framework is currently in public beta, with v1 planned for August 2026.

ActionRail addresses a blind spot in AI agent safety: the gap between permissions and correctness. Traditional authorization systems verify whether an agent is allowed to perform an action, and schema checks ensure the request is well-formed, but neither compares the actual values being passed against current system state. Red-team evidence shows this is a real risk—every model tested executed at least one malicious but syntactically correct request when unprotected, with success rates as high as 63.3%. The framework's approach is pragmatic: it intercepts tool calls at the execution boundary, queries live data sources (kept within the customer's VPC), and makes a final decision before the underlying function runs.

The design reflects constraints of production AI systems. Grounding decisions run cheapest checks first (policy expressions before database lookups) to minimize latency. Rules are composable—multiple grounding checks can be ANDed across different sources, comparing returned fields against caller context, literals, other arguments, or current time. Sources stay in the customer environment; credentials are resolved locally and never sent to the control plane. The optional Console provides visibility and rule authoring, but the security model does not depend on it: source lookups and credentials remain on-premises, and the tool executes only after an allow decision.

ActionRail also introduces Action Tests, which commit expected behavior as executable contracts alongside rules and run them through the same decision pipeline used in production. This makes allow, hold, and block decisions reviewable in CI without needing model API keys, live credentials, or network access—a practical way to catch configuration drift before deployment. The framework is currently in public beta, with v1 planned for August 2026.

No comments yet. Be the first to share your thoughts!