Trajeckt

Trajeckt is a runtime enforcement gateway that inspects the trajectory — the ordered sequence of tool calls an agent makes — and blocks chains that violate defined causal constraints, even when each individual call would pass a per-action check. The core workflow is interception: agent tool calls route through trajeckt, the gateway checks the call against trajectory state, and it either passes or blocks before the downstream tool executes. Policy is defined ahead of time in config; the docs describe a baseline trajectory file that encodes allowed sequences.

The differentiating design choice is trajectory-awareness. Per-action filters, the default in most guardrail setups, evaluate each call in isolation. That misses multi-step exploits: read-then-exfiltrate, enumerate-then-exfiltrate, or any pattern where harm only emerges from the sequence. Trajeckt tracks trajectory state across the session and applies causal rules to the chain, not the individual link.

This architecture fits tightly scoped, high-trust environments — internal tool-calling agents, MCP-compatible setups, or any deployment where the allowed call sequences are knowable in advance and worth encoding explicitly. It breaks when the threat surface is open-ended: if an attacker can construct a novel exfiltration chain you did not anticipate, there is no rule to block it. Teams that need probabilistic anomaly detection or rules that adapt to session semantics will find the deterministic engine a ceiling, not a floor, and typically add a second layer or move to a policy engine that supports learned baselines.

The repository includes Docker and Cargo setup paths, a Python SDK under sdk-python, deployment configs, and example trajectories. The vendor states latency at approximately 1.6ms per enforcement decision, and the gateway runs outside the model, which means prompt injection cannot reach the enforcement logic directly.