Built to be believed by the people who have to sign.
A governance layer is only worth what a risk officer, an auditor, and a regulator can verify about it. This page is what we can show, what we deliberately do not do, and what is not there yet.
Self-hosted. Nothing phones home.
One process, in your environment, on your Postgres. No AgentSnap account, no callback to us, no telemetry. Transaction data never leaves the building, and a DENY never depends on our uptime.
Fail-closed, by construction.
An action without a decision is a denied action. If the plane is unreachable the SDK denies locally. E-stop, quarantine, and spend counters are durable across restarts, so a reboot cannot quietly reopen the fleet or reset a budget. A production boot refuses to start on the development signing pepper or on SQLite, so a misconfigured deployment fails loudly.
Deterministic. No model in the path.
Every verdict is a policy check: grants, ceilings, allow-lists, velocity windows, reserve counters, signature verification. Same request, same verdict. A regulator can re-derive any decision from the policy and the request, which is what makes the audit chain worth keeping.
Identity from keys, not claims.
Each agent holds an Ed25519 signing key. Requests are signed over method, path, and body with freshness and replay bounds. A tampered body, a forged key, a replayed nonce, a stale timestamp, a revoked key, and an over-scope delegation are each a tested bypass that fails. Tokens are issued once and never stored in cleartext.
An audit chain you can break on purpose.
Append-only, hash-chained, covering agent and operator actions alike. The console verifies the whole log in one click and includes a tamper simulation so you can watch verification fail at the exact sequence number. Exports carry signed context; checkpoints bound how much history a verifier must walk.
Tested against its own bypasses.
233 automated tests gate every release, including an adversarial suite that replays twelve demonstrated enforcement bypasses, two audit defects, and four state-durability defects and asserts each is closed; a signed-identity suite that probes the key path one bypass at a time; and Postgres-parity tests against a real database.
Separation of duties, for agents and humans
The agent that screens an applicant is barred by policy from deciding on them. The agent that files a dispute cannot approve it. On the human side, the operator who requests a release cannot be the one who approves it, and every intervention (stop, revoke, cap change, release, restore) lands in the same chain as the agent actions it governs, with the operator's name on it.
Operator roles
The console is role-gated: fleet operator, risk and controls officer, finance approver, agent owner, auditor, and break-glass admin. An auditor can verify and export but not change policy; an approver can release a hold but not raise a cap. In the demo these are seeded personas. In a deployment the same role matrix sits behind your identity provider (that piece is roadmap; see below).
When the plane is down
Nothing executes. That is the design commitment, and the consequence is that a governance outage is a paused fleet, never an ungoverned one. So that a planned outage is not a payments outage, an operator can pre-issue a signed offline grant: a short-lived envelope bounded on amount, count, and action set. An agent cannot mint or widen one, and every action taken under it is reconciled into the audit chain when the plane returns.
What we say to regulators, and what we refuse to
The fleet report includes an evidence map: the run's artifacts resolved against five regulators' obligation sets. Every row says Evidenced, Partially evidenced, or Not covered, and never anything stronger. We do not make an institution compliant. An accountable officer attests; AgentSnap is the system of record for the artifacts they attest over. Each jurisdiction deliberately shows its Not covered rows (board cadence, independent validation, the model's own conceptual soundness) because an all-green map would be the tell of a tool overclaiming.
The same rule applies to numbers. Modeled economics are labeled modeled on screen. The only latency we quote is our own measured enforcement overhead. There are no customer logos, testimonials, or compliance badges on this site because we have none to show yet, and the product's brand is measurement honesty.
What is not there yet
- No SOC 2 or ISO 27001 certification. We are a pre-customer company; the architecture above is what we offer instead of a badge.
- Operator authentication is demo personas today. Your IdP behind the same role matrix is roadmap.
- Chain checkpoints are local. Externally anchored, signed checkpoints are roadmap.
- Transport-layer agent identity (mTLS / SPIFFE) is roadmap; application-layer signing is done.
- Coverage is set by where you put the gate. An agent with a direct path to a rail that bypasses the plane is ungoverned on that path. Deployment shape is the first thing we discuss on a call.
If you need a security questionnaire answered before a call, send it over. We answer it ourselves, in plain language, with roadmap items marked as such.