Enforce
Allow, deny, or hold for approval — decided before the side effect, not during a log review next quarter.
Hosted in Sweden · single-tenant per customer
Stop the refund your agent
Stop the refund your agent
should never have made.
An agent holding an API key can move money at 3am, and nobody notices until reconciliation breaks. We sit in front of that call. Every action your agents take gets checked against your policy before it runs — allowed, blocked, or parked for a human — and the whole thing lands in a ledger you can hand to an auditor.
0%
of tool calls pass through the gate. There is no bypass path.
0 ms
median decision time in our own load tests.
0 min
default life of a minted credential. Then it is dead.
What happens when an agent calls a tool
Four hops, every single time. The request never reaches your payment provider until policy has said yes and a short-lived credential has been minted for that one call.
-
01
The agent asks
It calls
refund_payment. It holds no provider key of its own. -
02
The gate decides
Policy runs against the arguments, the agent identity, and the current context.
-
03
A human, if needed
Anything over your threshold waits in an approval queue instead of executing.
-
04
The ledger writes
Request, decision, reason, result. Append-only, hash-chained, queryable.
The product is one loop, and we kept it that way on purpose
We would rather do four things properly than ship a dashboard full of charts nobody opens. If what you need is a general agent observability suite, we are not it.
Prove
Every attempt is recorded, including the blocked ones. Those are usually the interesting ones.
Identify
One identity per agent, credentials scoped to a single action and expiring in minutes. No more shared service keys.
Discover
See which agents are drifting outside the scope you registered for them, before somebody else finds out.
A 5000 EUR refund, caught
Here is the loop replaying against a test merchant account. The small refund goes straight through. The large one is stopped. The one in between waits for a person, and that person’s name ends up in the record next to the decision.
- Decisions are deterministic. Same input, same outcome, every time.
- The reason string comes from the rule that fired, not from a summary written afterwards.
- Approvals carry the approver identity into the ledger entry.
replay · refund-agent-eu-01
What the auditor actually gets
Not a narrative, not screenshots of a chat window. Rows, with a hash chain behind them.
| Time | Agent | Action | Decision | Reason |
|---|---|---|---|---|
| 14:22:09 | refund-agent-eu-01 | refund_payment 89.00 EUR | allowed | under the 250 EUR auto-approve line |
| 14:22:34 | refund-agent-eu-01 | refund_payment 5000.00 EUR | denied | rule refund.ceiling, no approval attached |
| 14:23:07 | refund-agent-eu-01 | refund_payment 700.00 EUR | approved | held 38s, released by k.lindqvist |
Why teams call us
- They already have agents in staging and no story for the risk review.
- Their logs tell them what happened, but nothing stopped it happening.
- One API key is currently shared by four agents, and they know it.
Where we are right now
- Founder-led, registered in Sweden, building alongside our partners.
- Taking on a small number of EU fintech design partners this quarter.
- Deliberately narrow scope. We will tell you when we are not the right fit.