Authorize the action, not the language.
RADM creates a deterministic execution boundary between AI agents and enterprise tools. It evaluates authority, provenance, operational state and intended effect before consequential actions are permitted to execute.
AI Agent
Probabilistic
Proposed action
Not yet permitted
Tajalli RADM
Deterministic
- identity
- authority
- provenance
- effect contract
- consequence state
- policy
Execution broker
Exclusive boundary
Tools · APIs · Systems
Consequence
01Principle
Proposal is not permission.
Modern agents can reason probabilistically. Enterprise authority must remain explicit.
RADM allows organizations to keep powerful AI models while placing deterministic control over what those models are permitted to cause.
- Proposal
- ≠Permission
- Evidence
- ≠Authority
- A plausible request
- ≠An authorized effect
02Category
Not a guardrail. A runtime authority and execution control plane.
Prompt filters and LLM guardrails inspect language. RADM does not depend on detecting a malicious instruction; it decides whether a specific effect is authorized given identity, provenance and state — and only then lets it execute.
Traditional
The model's output is the authorization. Whatever the agent is persuaded to request, the tool receives.
With Tajalli RADM
- 01Agent
- 02Proposed action
- 03Authority + provenance + effect evaluation
- 04Deterministic decision
- 05Controlled execution
- ALLOW
Authority, provenance and effect are satisfied.
- REQUIRE APPROVAL
The effect requires an explicit human decision.
- BLOCK
The action is not authorized to execute.
03Capabilities
Every consequential action passes one deterministic boundary.
- 01
Runtime Authority
Authority is evaluated at the moment of execution against explicit grants — not inferred from the model's confidence or the phrasing of a request.
- 02
Effect-Centric Control
Decisions are made on what an action will cause, declared through effect contracts, rather than on the text that requested it.
- 03
Tool Identity
Each tool and operation carries a stable identity and declared effect surface. Unknown tools are not executable by default.
- 04
Provenance Binding
Arguments are bound to their sources. Content that arrived from an untrusted channel cannot silently become an instruction with authority.
- 05
Consequence-Sufficient State
RADM evaluates against the operational state needed to judge the consequence — balances, scopes, environments, prior effects.
- 06
Human Approval
Where policy requires it, effects are staged and held for an explicit, attributable human decision before commit.
- 07
Execution Broker
Permitted actions execute through an exclusive broker. The agent does not hold the credentials that would let it bypass the boundary.
- 08
Commit / Abort
Multi-step effects are staged with explicit commit and abort boundaries, so partial execution does not become an unreviewed outcome.
- 09
Receipts & Replay
Every decision and witnessed effect produces a receipt. Decisions can be replayed against the recorded state and policy.
- 10
Multi-Tenant Isolation
Authority, state and policy are partitioned per tenant. One tenant's context cannot grant authority in another.
- 11
Fail-Closed Operation
Missing state, unknown tools or unverifiable provenance resolve to no execution. Absence of evidence is never permission.
04Integration
Place a deterministic execution boundary between autonomous reasoning and consequential action.
The architecture is designed to mediate actions wherever an agent reaches a system that can change state.
Designed to mediate
- MCP tools
- Function calling
- Internal REST APIs
- Enterprise SaaS actions
- Cloud operations
- Database operations
- Financial workflows
- Workflow automation
- Internal AI agents
- Multi-agent environments
- Privileged enterprise tooling
Integration scope is confirmed per deployment. Listed surfaces describe architectural fit, not native connectors.
05Controlled evaluation
Validated in controlled authorization and agent-action benchmark environments.
RADM
Controlled authorization benchmarks
A ground-truth-contract configuration of the public AgentDojo benchmark, and a separate holdout set of authorization cases.
- safe cases in the evaluated ground-truth-contract AgentDojo configuration
- 949 / 949
- successful evaluated attacks in that configuration
- 0 / 949
- holdout authorization cases in a separate controlled evaluation
- 484
- recall in that evaluated holdout
- 100%
- false-positive rate in that evaluated holdout
- ~0.495%
Benchmark results apply to the stated evaluated contracts and configurations. They do not constitute universal security completeness.
06RADM questions
What platform and security teams ask about RADM.
Is RADM another LLM guardrail?
Not in the conventional sense. Most model-level guardrails focus on generated content, prompts or responses.
RADM is designed around runtime authority and effect control. The important question is not only “What did the agent say?” but “What is the agent actually permitted to cause?”
Can an agent bypass RADM and call the tool directly?
The strongest deployment architecture places consequential execution behind an exclusive mediated boundary.
If an agent retains an independent path directly to the underlying tool, no middleware layer can truthfully claim complete execution control over that bypass path.
The deployment architecture therefore matters as much as the runtime decision engine.
What happens when authority is ambiguous?
RADM does not resolve ambiguity in favor of execution.
If identity, authority, provenance or the consequence-relevant state cannot be established for an action, the action is blocked or routed to an explicit approval path, according to policy. Ambiguity is a reason to stop, not a reason to guess.
Does RADM need to inspect prompts?
Not as its primary mechanism. RADM decides on the proposed action: which tool, which operation, which arguments, from which sources, with which effect.
Prompt or conversation context may be recorded as provenance where useful, but authorization does not depend on interpreting the model's language.
Can humans remain in the approval loop?
Yes. Policy can require explicit human approval for specific effects, thresholds or tools.
Such actions are staged rather than executed, held for an attributable human decision, and then committed or aborted. The approval itself becomes part of the decision record.
Can RADM stop every possible AI attack or unsafe action?
No responsible system should make that claim.
RADM is designed to reduce specific classes of unauthorized or invalid execution by imposing an explicit deterministic authority boundary before consequential tools. Its protection depends on the integration boundary, the evidence available, policy coverage and the set of actions actually mediated by the system.
Controlled benchmark results must not be represented as universal security proof.
Enterprise enquiries
Agents may remain probabilistic. Authority does not have to be.
Discuss placing RADM in front of the tools your agents already use, starting in observe-only mode.