Control what agents can do. Prove what actually happened.
Policies are evaluated deterministically before anything runs. Sensitive actions wait for humans. After execution, verifiers read the target system independently and the result is written to a hash-chained receipt.
- 1Action
Typed request from an agent, workflow or API
- 2Policy
Deterministic allow / deny / require approval
- 3Approval
Bound to the exact payload hash
- 4Execute
Isolated worker, allowlisted egress
- 5Verify
Independent read-back of real state
- 6Receipt
Hash-chained evidence of what happened
Capabilities and current status
Deny-by-default policy
Rules match on tool, connector, risk class and environment, with conditions on input values (e.g. amount > 10,000). Most restrictive match wins. Protected resources and domain allowlists.
Platform guardrails
High-impact actions always require two distinct approvers, regardless of tenant policy.
Versioned policies with tests
Every publish creates an immutable version. Test cases must pass before a version becomes active. Safe preview mode.
Approvals bound to payloads
An approval is tied to a hash of the exact action, target and policy version, and it expires. Any change invalidates it. Requesters cannot approve their own actions.
Typed verification
field_equals, record_exists, count, arithmetic invariants, status transitions, HTTP postconditions, artifact hashes, human attestation; model assessment is labelled probabilistic and never sufficient alone.
Safe retries
Only idempotent actions or requests that never reached the server are retried. Lost responses on non-idempotent actions are verified, not re-sent.
Receipts
JSON and readable views with policy, approvals, preconditions, execution, checks, caveats. Per-workspace hash chain with a verification endpoint.
Compensating actions
Tools declare compensations (e.g. void a draft invoice). Automatic compensation runs are not enabled yet.