How the control plane works.

The decision pipeline

Every action hits one endpoint with the agent's credentials and runs this ordered, fail-closed pipeline. The order matters: the cheapest, most absolute checks run first, so an emergency stop is never waiting behind an FX lookup.

1. AuthenticationBearer token or Ed25519-signed request. An unknown caller gets nothing, not even an error that says why.
2. Fleet emergency stopIf the kill switch is set, deny. Checked first, and re-checked when a held action is released.
3. Revocation and quarantineA revoked or quarantined agent denies here regardless of what its policy would allow.
4. IdentityThe signature verifies against the registered key; the nonce is fresh; the timestamp is inside the freshness window. A delegated key resolves to the delegator's policy.
5. FX normalizationEvery amount is converted to USD before any ceiling is compared. An unknown currency is a deny, not a guess.
6. PolicyDefault-deny. Is this action, on this resource, granted to this agent, under these conditions (ceiling, category, counterparty, time window)? Separation of duties between agents is enforced here.
7. ReadinessJourney-stage prerequisites: a card cannot activate before the downstream systems it depends on are provisioned.
8. Caps and velocityAtomic check-and-reserve against per-transaction, per-agent daily, per-category daily, and per-fleet daily counters, plus a rolling attempt-count window.
9. RiskPolicy-clean but risky actions (near a cap, unestablished counterparty, high-risk category) become a HOLD for a named human instead of executing.
10. ALLOW, reserve, ledgerBudget is reserved, the rail adapter executes, the ledger posts idempotently on the audit sequence. A failed execution refunds the reservation.

Every outcome, including every DENY, is appended to the hash-chained audit log and broadcast to the console over a WebSocket. Measured on a laptop, the full allow path is about 0.7 ms at p50, including the durable audit write and the ledger entry.

Identity and delegation

Identity comes from a registered Ed25519 signing key, never from a field in the request. Requests are signed RFC 9421-style over method, path, and body, with freshness and replay bounds: a tampered body, a forged key, a replayed nonce, a stale timestamp, and a revoked key are each a tested bypass that fails.

A delegated key acts under the delegator's policy, so a mandate can never exceed the scope of the agent that granted it. Authority narrows down a chain and never widens. Register, rotate, and deactivate are endpoints; tokens are issued once and never stored in cleartext. Bearer tokens remain as a compatible parallel path.

Caps and reserve-then-settle

Counters are check-and-reserve, atomic, and durable: they survive a restart, so a reboot cannot reset anyone's budget. A live cap edit takes effect on the next action. The engine is deliberately single-threaded so reserve is atomic; scaling is horizontal.

The HOLD queue

A HOLD pauses the actual in-flight action, not a ticket about it. It waits on a queue with a timeout and an escalation path. Expiry is a deny, never a silent pass. When an approver releases it, the whole pipeline above runs again, so an approval cannot outrun the kill switch, a revocation, or a cap that was consumed in the meantime. Separation of duties applies to the humans too: the requester can never be the approver.

The three stops

• Fleet emergency stop. First check in the pipeline. Flips in about a hundredth of a millisecond, denies the next action including a payment already held for approval, and survives a process restart. Requires a reason, which lands in the chain.
• Per-agent revoke. With a statement of consequence: the confirmation names which journey stages and which in-flight applicants stall if you revoke this agent, walked from the journey's enforced prerequisite edges.
• Auto-quarantine. An incident engine watches for a burst of denials on one agent and quarantines it without a human. Every further action denies until an operator restores it, which is itself an audited action.

The audit chain

Append-only and hash-chained, covering agent actions and operator actions in one sequence: who stopped the fleet, who raised a cap, who released a payment. Any alteration breaks the chain and the verifier pinpoints the record. The console verifies the whole log in one click and can simulate a tamper so you can watch it fail. Filterable, exportable as signed-context JSON or CSV, with chain checkpoints.

The agent dossier and the fleet report

The control plane is the only component that sees every attempt, allowed and denied alike. That position makes two things computable that no trace can produce.

The dossier answers "should this agent hold this authority, at this cost?" Per agent: which granted permissions it has never used, which control actually binds its denials, modeled economics including the value its denials blocked, and the blast radius of revoking it. Blocked value is the one number in the product that argues against tightening a control.

The fleet report answers "what is about to happen?" Six sections computed live from the chain and current policy state, never pre-written: near-misses (actions that passed every hard control while inside 10% of one), permission decay, behavioural drift against each agent's own baseline, control saturation (controls that have never bound: dead policy or untested defence, and it says which it cannot tell), HITL health, and concentration risk. Every line cites the audit sequence numbers behind it. Empty sections render as checked-and-empty rather than hidden. It downloads as JSON.

The evidence map

The same run's artifacts resolved against five regulators' obligation sets, switchable live in the console: RBI draft model risk guidance (2026), SR 26-2 / OCC 2026-13 with its explicit agentic-AI scope exclusion, EU AI Act Article 50 and the deferred Annex III(5)(b), MAS AI risk guidelines, and PRA SS1/23. Every row says Evidenced, Partially evidenced, or Not covered, and never anything stronger. No tool makes an institution meet a regulation; an accountable officer attests, and AgentSnap is the system of record for the artifacts they attest over. Each jurisdiction deliberately shows its Not covered rows. An all-green map would be the tell of a tool overclaiming.

The demo fleet

The demo models a fictional card issuer, Meridian. Seven agents carry a prospect from application to active card, because a fleet only matters when the agents depend on each other:

Traffic is real, not scripted: start an application from either screen and the fleet carries it stage by stage. Workers reason with a model when a key is present and act deterministically without one, so the demo runs offline. The injected servicing agent is a script you run yourself and watch get quarantined.

Integration

Today: an SDK-style call before each consequential action, authenticated by the agent's signing key. It is a pull request into each agent, and for design partners we write it. If the plane is unreachable the SDK denies locally, because a governance layer that fails open is not one. For a planned outage, an operator can pre-issue a signed offline grant: a short-lived envelope bounded on amount, count, and action set that an agent cannot mint or widen, reconciled into the chain when the plane returns.

Deployment is one container plus Postgres. The interfaces are the real swap points: the policy engine, the spend counters, the rail adapter, and the store each sit behind one interface.

Roadmap, honestly

Anything marked roadmap is not in the product today. We would rather you hear that here than on the call.