ActionRail: Runtime Value Grounding for AI Agent Tool Calls

ToolJet has released ActionRail, an open-source runtime framework that verifies AI agent tool calls against live system data before execution. While allowlists and schema checks can confirm a call is well-formed and permitted, they can't catch a perfectly valid-looking action with a wrong value — like refunding an already-refunded order or transferring funds to the wrong account.

ActionRail intercepts consequential tool calls and grounds each argument against a system of record, returning allow, hold-for-human, or block decisions through a tiered, cheapest-check-first pipeline. It supports SQLite, PostgreSQL, MySQL, HTTP/REST, and MCP gateway sources, with credentials and queries staying inside the customer's environment rather than reaching a control plane.

The framework is framework-neutral via a Python SDK, with a LangGraph adapter offering automatic tool discovery and wrapping. It's currently in public beta ahead of a planned v1 release in August 2026.

In red-team testing across eight models from four providers, unprotected agents executed at least one poisoned value in every case, with attack success rates from 1.7% to 63.3% regardless of model strength. With ActionRail enforcing, zero of 480 manipulated actions executed and zero of 480 legitimate requests were wrongly blocked — addressing a gap that policy engines like OPA or Cedar, which lack runtime I/O, cannot close on their own.