← All Heat demos Heat AI Tool Gateway · compile-time reference monitor

Every agent action is mediated at the boundary—
unsafe ones refused before the binary is built.

Your agent stays where it lives. Its outbound tool calls route through one small compiler-checked boundary that mediates every egress — complete mediation, no runtime bypass. Safe payloads pass. Injected arguments, out-of-order calls, and policy violations bounce, each with a real compiler diagnostic as proof.

Now mediating: — Auto-playing · every line is real heatc output
in flight passes (repaired) refused at compile
Your agentHeat gateway · reference boundaryExternal world

LLM agent

Reasons, then emits tool calls. Any argument may be prompt-injected; any call may be out of order.
db_tool(query)argument decoded from model output payment.charge()must authorize() first file_tool(path)user-controlled path

Compiler-checked boundary

Provenance: injected input can't reach a sensitive sink.
Protocol: tools are called in a legal order.
Obligation: your egress policy is a compile error.
heatc — real compiler output

            

          


          

            
Destinations

            
Only what clears the boundary reaches the outside.

            Allowedlaundered arg · in-order call · path_safe
            Refusedinjected SQL · charge-before-auth · user_input→fs
            DB · Stripe · Slack · logs · partner APIsfilesystem · SIEM · GitHub · AWS
          

        

      


      

        
Where it lives
The egress edge of an agent framework: where model decisions become real actions.

        
Same engine, PCI/egress
Swap the tags: raw PAN / @secret provably can't reach a webhook or log. One boundary, many blast radii.

        
Proof, not policy docs
Every refusal is a real NL-XXXX diagnostic — captured, not mocked. Verify: capture.sh compiles the flow files and writes proof.json.