Control what AI agents can actually do.
Authorize consequential agent actions in real time and produce verifiable evidence of those decisions.
Free Developer workspace. No credit card required. See your first steps
- Refund €8,250
- Policy: over €500
- Approval required
- Evidence generated
Illustrative. Holds apply in enforce mode; approving a held call is in every plan.
Controls mapped to, not certified against
See a risky action stopped.
One agent, one MCP tool, one €8,250 refund — held until a person approves it, and the receipt it leaves behind.
-
1
An agent turns up
Invoice Agentowner: Finance Platform
Seen in your OpenTelemetry traces, then linked to a registered identity and adopted into the asset inventory.
-
2
Its connections are inventoried
Customer databaseStripe MCPSlack
Stripe MCP: 12 tools, each listed with what it does.
-
3
One permission matters more than the rest
stripe.refund — write · moves moneycustomer records — read
What it can do, and to what, spelled out in plain words.
-
4
The agent tries to use it
REQUEST · agent invoice-agent · action stripe.refund · amount €8,250
-
5
Praesidia evaluates the call
Identity Valid
Permission Allowed
Policy Amount > €500
Approval Missing
-
6
The refund waits for a person
Held for approval
Refunds above €500 require human approval, so the call pauses instead of running.
Held Waiting for Finance Platform
Approved By a person, not the agent
Executed The refund runs as approved
-
7
The decision leaves a Decision receipt
actorinvoice-agentactionstripe.refundamount8250 EURpolicyrefund-approval v3 (amount > 500)decisionheld — human approval requiredreasonApproval required above €500approvalapproved · Finance Platformresultexecutedevidencesigned + hash-chained · VERIFIED
The refund scenario, agent graph and decision record on this page are illustrative: the real rule shape, not customer data. A managed MCP record establishes observed dispatch and response; it does not independently prove completion of the external refund. Holding a call applies when the organization runs in enforce mode. Approving a held call is in every plan; multi-step approval workflows are Enterprise — compare plans.
-
Discover
Find the AI agents you didn’t know were running.
Agents surface from your OpenTelemetry traces, from the API and SDK you register them with, and from strangers that try to talk to the ones you already run. Agents with no owner are listed too — the first question every review asks.
Every registered MCP server is inventoried tool by tool, and a tool definition that changes after you approved it is flagged as drift.
Invoice Agent
- Customer database
- Stripe MCP
- Slack
12 tools
stripe.refund
write · moves money
Invoice Agent
- Owner
- Finance Platform
- Connections
- 3
- Tool permissions
- stripe.refund — writecustomer records — read
- Rule
- stripe.refund — approval required above €500
-
Secure
Decide exactly what every agent you connect can do.
Enforce identity, per-tool permissions, argument conditions and approval policies before a sensitive action runs — then quarantine, suspend or revoke an agent in one move.
Rules read the arguments, so the same tool can be allowed under €500 and held for a person above it. New policies run in observe mode first — the verdict is recorded without changing the outcome — until you turn enforcement on.
One tool call, evaluatedREQUESTagent invoice-agent · action stripe.refund · amount €8,2501Identity verified — the agent’s own short-lived credential2Tool permitted for this connection3Rule matched: amount > 500BLOCKEDhuman approval required -
Prove
Know exactly what happened — and prove it.
Praesidia records the decisions it makes in an append-only, hash-chained trail, signed under the default configuration, naming the actor, the action, the argument that mattered, the rule that matched, and the decision. A signed record shows it was not changed afterwards. It does not show that every action was captured.
Export a signed bundle for independent verification; CSV and JSON are reporting formats. Check the bundle without us: praesidia-verify is an independent offline verifier that re-walks every signature and the whole chain on your own machine.
Decision recordThe fields a held refund leaves behind · Illustrative*actorinvoice-agentactionstripe.refundpolicyrefund-approval v3 (amount > 500)decisionHeld for approval — human approval requiredsignature VERIFIEDVerified offline, record by record.
Built for the stack you run and the auditors you answer to.
Connect supported agent and model routes to Praesidia, apply controls on those routes, and review how they map to the frameworks your compliance team uses.
Works with
- OpenAI
- Claude
- LangGraph
- MCP
- A2A
- OpenTelemetry
Building the agent yourself? Find the recipe for your framework.
Check us before you trust us: run the independent verifier, read the public changelog, browse the documentation, or open the integration catalog.
Framework mappings support your review; they do not constitute certification or a guarantee of compliance.
Proud member of
Read the reference before you pick a tool.
Six guides on securing, governing and auditing AI agents: what to require, how each control works and where it stops.
Secure the runtime
- AI agent security guideIdentity, authorization, guardrails, trust scoring and incident response for autonomous agents.
- MCP security guideAuthentication, tool-level authorization, rate limits and a hardening checklist for MCP servers.
- BYOK AI gateway guideWhat a bring-your-own-key LLM gateway should enforce, and how it differs from MCP and API gateways.
Govern and prove
- AI governance guideControl points, human oversight, budgets and framework mappings for agent programs.
- Identity and access for AI agentsScoped credentials, rotation and revocation for non-human identities.
- AI agent audit trail guideWhat an audit trail must record, and how tamper evidence is checked offline.
Design partners
We are taking on a small number of design partners running agents in production. You work directly with the team and have a say in what gets built next.
Test one control. Inspect the decision.
Create a free workspace, run the synthetic rule sample, then choose a supported path to connect your agent.