Railpane

Railpane exists for the moment an agent is allowed to touch something that matters — a production deploy, a write to a customer record, a purchase. Instead of trusting the model's judgment, every consequential action goes through one gateway that evaluates the agent's identity, its delegated authority and a versioned policy, then returns ALLOW, DENY or REQUIRE_APPROVAL. The sample call on the site shows a deploy request coming back as REQUIRE_APPROVAL against a named policy version.

Enforcement is not just a decision log. Credentials are brokered per task, temporary and scoped, so an agent holds only what the approved action needs; execution runs inside host sandboxing (the Paldron engine uses Gate and Landlock) with MCP governance, bound to the exact approved digest. Annalist records the run so it can be gated and rewound, and Seal compiles one policy file into a form every engine consumes.

The proof layer is a signed receipt linking evidence, policy and result — the artifact you hand to an auditor rather than a transcript. Six open-source engines sit underneath, each described as useful standalone with Railpane's value being the trust layer between them, and client libraries are shown for cURL, Python and Go. It is currently sold as design-partner pilot access at $500/month with two slots per cohort, aimed first at coding and DevOps agents, with docs and a downloadable client on the site.

Gating production deploys and destructive operations behind human approval; issuing temporary scoped credentials per agent task; producing signed receipts that link a decision to its policy version; governing which MCP servers an agent may reach; verifying that a code change matches the task it was given.

The product's own site does not publish a privacy policy or data-handling notes as of this review. That is an unknown, not a claim that no data is collected — check the site before you share personal data.