Skip to content
DPHDeterministic, payload-bound, hash-chained

Let Agents Work.Keep The Calls.

AgentPlane sits between your agents and the tools they call. Low-risk work runs on its own and is verified afterwards. Anything consequential waits for an authorized person, who sees exactly what will happen before it does.

Try the live engineExplore the console
4
Decision outcomes
100%
Actions audited
30min
Approval expiry
0
Implicit allows

Why it matters

Useful agents need permissions. Permissions need a supervisor.

The moment an agent can send an email, update a record or move money, someone has to decide what it may do on its own. Most teams end up choosing between two bad options.

Review everything

Reviewers drown in approvals, start clicking yes, and the control becomes theatre.

Review nothing

Agents run on broad credentials, and the first sign of trouble is a customer complaint.

AgentPlane gives you a third option: explicit rules for what is routine, a person for what is consequential, and proof of which was which.

01 · Live demo

Pick an action. Watch it get decided.

This is the production policy engine running in your browser, with the same starting rules a new workspace gets. Change the environment, send it outside the company, or drop the requester, and see the answer change.

Live policy engine · starting policy set · nothing executes

Pick an agent action

An agent asks to

Action envelope

agent
agt_support
principal
[email protected]
objective
Resolve support case 48213
action
email.send (send)
resource
email/customer:jordan.alvarez
sensitivity
confidential
records
1
payload
{ "to": "[email protected]", "subject": "Your refund of $84.00 is on its way", "template": "refund_confirmed" }

Supervision path

  1. 01Observe
  2. 02Understand
  3. 03Risk-score
  4. 04Verify
  5. 05Enforce
  6. 06Escalate
  7. 07Learn

Decision

Require approval

Held. An authorized person sees this exact payload and decides before it can run.

Risk score

61 / 100 · HIGH
  • Impactsend operation+18
  • Sensitivityconfidential data+15
  • Reversibilityhard to undo+10
  • Destinationleaves the organization+10
  • Environmentproduction environment+8

Reason codes

EXTERNAL_SIDE_EFFECT

Obligations

HUMAN_APPROVAL, POST_ACTION_VERIFICATION

Matched policies

  • winsExternal communicationv3 · REQUIRE_APPROVAL

Evaluation trace

  1. observeemail.send on email/customer:jordan.alvarez
  2. understandAgent active and tool in scope
  3. riskScore 61 from 5 factors
  4. verifyPrincipal, objective and target present
  5. enforce"External communication" v3 decides

02 · How it decides

The same seven checks, every time.

Every request takes the same route in the same order and leaves the same evidence. Predictable answers are what let you hand agents more autonomy, one policy at a time.

  1. 01ObserveCapture what the agent wants to doOne envelope: who asked, why, which tool, on what, with which payload.
  2. 02UnderstandConfirm the agent is allowed to tryRegistered identity, active credential, and the tool is on its list.
  3. 03Risk-scoreWeigh what could go wrongImpact, data sensitivity, reversibility, scope and destination, each scored in the open.
  4. 04VerifyCheck the context holds upA real person behind the task, a stated objective, an unambiguous target.
  5. 05EnforceApply one of four answersAllow, deny, require approval or escalate, signed and time-limited.
  6. 06EscalateBring in a person only when it mattersThe approver sees the exact payload and decides in one click.
  7. 07LearnTune the rules from real outcomesReviewers flag false positives and gaps. Policies never change themselves.

03 · Outcomes

Four possible answers. Each says what happens next.

OutcomeWhenWhat happens next
AllowAn explicit allow policy matches and risk stays inside its bounds.Runs through the enforcement point with a receipt and a postcondition check.
Require approvalConsequential actions such as external email, customer record changes or payments.Held. The approver sees the exact payload. Approval is bound to its hash and expires.
EscalateThe principal, objective or target is missing or ambiguous.A reviewer gets the full context. Nothing is trusted by default.
DenyA hard rule matches, no policy covers it, the agent is off, or the kill switch is on.The enforcement point refuses it. The attempt is still audited.
AgentPlane architectureAn agent sends an action to the enforcement point. The enforcement point asks the decision point for a signed decision, then calls the protected tool only if the decision allows it. Approvals and the audit chain connect to the decision point.AGENTPLANE TRUST BOUNDARYAI agentany frameworkany modelEnforcement pointgateway, SDK wrapper or adapterverifies token, hash, expiryKILL SWITCHProtected toolsemail, CRM, paymentsdatabases, cloudDecision pointidentity, policy, riskpure and deterministicactionif validevaluatesigned decisionApproverexact payload, expiryAppend-only audit chainrequest · decision · approval · execution · verification · policy and credential changes
Figure 1. The monitored agent sits outside the boundary and cannot reach policy, audit or the kill switch.

04 · Where it sits

The agent never holds the keys.

One part decides; a separate part, which you control, executes. The enforcement point refuses any call without a valid, unexpired, signed decision for that exact payload, and the agent being supervised cannot reach policy, audit or the kill switch.

Worth knowing: an action that skips the enforcement point is not protected. Keep tool credentials behind it, not in the agent.

05 · Principles

Rules your security team can read back to you.

  1. 01

    Deterministic first

    Rules make every enforcement decision, so the same action always gets the same answer. Models may one day explain or suggest. They will never override a hard deny.

  2. 02

    Fail closed

    If a policy or a required piece of context is missing, the answer is no. There is no implicit allow.

  3. 03

    Separation of duties

    The agent being supervised cannot change its own policy, delete audit records, approve its own action or turn the supervisor off. The person who started a task cannot approve it either.

  4. 04

    Least privilege

    Agents are scoped by tool, resource, operation, environment, volume and amount.

  5. 05

    Every decision explains itself

    Reason codes, matched policy versions and each risk factor's contribution are stored with the decision.

  6. 06

    Vendor neutral

    Works with any model provider or agent framework through one action envelope.

06 · Pricing

Free in the sandbox. Priced by agents and actions.

Every plan includes the full safety core. You pay for scale, retention and support, from $0 for developers to custom enterprise terms.

Compare plansStart free

07 · Design partners

We are looking for teams already running agents against real systems.

We would rather show you numbers from your own traffic than quote anyone else's. Together we measure review time, exception rate and false positives, then decide what to hand over to policy.

  • A sandbox workspace with your agents registered
  • Policies written with you against your real tool list
  • Weekly review of exceptions and false positives
  • A written security review before any production enforcement
Apply for the pilotStart free in the sandbox