Verifiable security decisions.

SubPolicy is a portable platform for building trustworthy AI systems. As AI agents gain access to tools, infrastructure, and sensitive data, every request becomes a security decision. SubPolicy helps make those decisions transparent, reproducible, and verifiable.

Try demo →Read the docs

From request to verifiable decision

SubPolicy turns an AI request into evidence, evaluates that evidence with deterministic policy, and returns a decision that can be explained, reproduced, and verified.

01

Receive request

Capture the prompt, tool call, metadata, or system action that needs a security decision.

02

Run classifiers

Evaluate the request with specialised MLP classifiers for PII, secrets, injection, tool risk, and more.

03

Collect evidence

Normalize classifier scores, labels, and supporting evidence into a consistent decision input.

04

Decide

Use deterministic rules to decide whether to allow, deny, review, redact, or restrict the request.

05

Return proof

Produce an explainable decision object, with optional cryptographic proof of what executed.

See exactly how every decision was made.

SubPolicy turns classifier outputs into deterministic policy decisions that can be inspected, reproduced, and verified.

Example request

Lets meet at Gablerstrasse 15, 8002 Zürich, Switzerland

PII classifier score: 912 · Decision: Review

Define the policy

policy LandingPiiExample(input) {
  use classifier subpolicy/pii as pii;

  rule review_pii {
    evaluate input using pii as input_pii;
    when input_pii.score.full_text >= 600
    review "Potential PII detected"
  }

  default { allow }
}

Decision

Review

Verified components

Classifier
subpolicy/pii
Policy digest
sha256:42a1…7c09

Classifier output

  • full_text912
  • lines_max912
  • sentences_max912
  • aggregate max912

Reusable security classifiers for every gateway.

Discover, publish, and compose verifiable classifiers for AI safety, tool access, code security, infrastructure approval, and more.

Explore classifier packages →

Credential request

subpolicy/agent-tool-credential-request

Detect requests for credentials and sensitive access material.

1.0.0

Destructive command

subpolicy/agent-tool-destructive-command

Identify tool commands that can delete or irreversibly alter resources.

1.0.0

Filesystem

subpolicy/agent-tool-filesystem

Classify agent tool requests that access or modify the filesystem.

1.0.0

Network

subpolicy/agent-tool-network

Classify network-bound tool use and external connectivity requests.

1.0.0

Privilege escalation

subpolicy/agent-tool-privilege-escalation

Detect requests that elevate permissions or bypass access controls.

1.0.0

PII

subpolicy/pii

Detect personally identifiable information in user input.

1.0.0

Built for the future of trustworthy AI.

Try SubPolicy in your browser, then run the same classifiers and policies on servers, Kubernetes, mobile applications, embedded devices, or confidential computing environments.

Try demo →

Build once

Write classifiers and policies once, then reuse them across projects and teams.

Deploy anywhere

Run the same security logic in browsers, servers, Kubernetes, mobile apps, and edge devices.

Explain every decision

Understand exactly why a request was allowed, denied, reviewed, or modified.

Trust every release

Verify the classifiers, policies, and software behind every security decision.

Integrate easily

Use the SubPolicy CLI, SDKs, and APIs to integrate with existing AI gateways and applications.

Portable

Compile to WebAssembly for deterministic execution across every supported platform.