The control plane for AI agents
Rules, approvals, budgets and an audit trail for every model and tool call. Change one base URL; nothing to install.
Every decision here comes from Cartha's real rule engine. Type an action, switch a rule, approve a hold.
Works with anything that can set a base URL.
OpenAI · Anthropic · Gemini · Azure OpenAI · Bedrock · Vertex · Groq, Together or your own vLLM / Ollama
any SDK, LangChain, CrewAI, LlamaIndex, n8n, Make, Copilot Studio, MCP clients
Rules
Stop the action before it happens.
Write rules in plain language or as checks: who an agent may email, how much it may refund, which data may leave. Every model call and tool call is judged first; a refused call never reaches the provider or the tool. Try it: change the recipient.
Rule · Email only acme.in
Checking…
Approvals
A person decides the risky ones.
Refunds over a limit, payments, deletes: the call waits while an approver gets a Slack message with the exact action. One click approves that one call, once. Drag the amount and see where the rule starts holding it.
Rule · Refunds over ₹10,000 need approval
refunds-agent wants to issue a refund of ₹48,000
Checking…
Evidence
Every decision, on the record.
Each call gets a decision record: the rule, the reason and how long the check took, written before the response is released. Edit the message and see what Cartha masks and records.
Decision record · what Cartha returns
// checking…
Use cases
What teams put Cartha in front of.
Cap what an agent can spend
Give an agent a budget and its model and tool calls are charged to it; once it is used up, calls are refused before they reach the provider. Slack hears at 80% and again at 100%.
Keep customer data out of prompts
Emails, phone numbers, card numbers, national IDs, IP addresses and API keys are masked before the prompt reaches the model provider.
Block prompt injection
Inputs are checked for injection and jailbreak attempts with phrase rules, a trained classifier, or both. A flagged call is refused, and the reason is recorded.
Approve risky tool calls
Refunds, payments and deletes wait for a person, who gets the exact action in Slack. Tools outside an agent's allow-list are refused outright.
Investigate what an agent did
Every call becomes a trace: prompts, tool calls, the rule that applied and why. Open it step by step when something goes wrong.
Govern your own models
Point Cartha at vLLM or Ollama inside your network and the same rules apply. Fail over from OpenAI to Azure OpenAI, or Gemini to Vertex, when a provider is down.
One line to start.
Change your app's base URL to Cartha. Same models, same code; every call now governed.
The model name picks the provider. Chat, Responses, embeddings and Anthropic Messages share the same URL.
Benchmarks
Measured on public datasets.
Test splits only: the classifier was trained on the train splits and never saw these. Measured on 20 October 2026 on a laptop CPU, with no network calls. Weak spots included.
Prompt injection and jailbreaks
Trained classifier. Share of attacks caught, and of harmless prompts wrongly flagged.
xTRam1/safe-guard-prompt-injection
2,060 cases
jayavibhav/prompt-injection
5,000 sampled cases
jackhhao/jailbreak-classification
262 cases
deepset/prompt-injections
116, mostly German cases · our weak spot
deepset is mostly German and we had little non-English training data; it needs more. The phrase rules alone catch far less (0.0% to 29.5%) but never flagged a harmless prompt. A check takes 0.65 to 2.06 ms on average.
Personal data masking
gretelai/gretel-pii-masking-en-v1, 5,000 test documents, every category on.
Not covered yet: names, addresses, dates of birth and other free-text identifiers. Those need a model-based detector. Masking takes 0.058 ms per document on average.
Built for teams that answer to risk.
Fails closed
If a call cannot be checked, it is not sent.
Your data stays yours
Isolated per organisation in the database; hosted in India, or in your own network.
SSO and SCIM
OIDC or SAML sign-in; people added and removed by your identity provider.
Your keys
Stored credentials encrypted, optionally under your own KMS key.
About 20 ms
Added at p95 per call in our benchmark.
Honest status
SOC 2 and a penetration test are planned, not done. We say so.