Financial services
A refund is the reference case because an API returning 200 is not proof the customer got their money.
This is already on your desk.
- 01
The actions are irreversible and externally observable
A refund, a payment instruction, a limit change, a ticket transition. Each has a counterparty who noticed, a ledger that recorded it and a customer who can complain, which is what makes the model's own account of what it did unusable as evidence. - 02
Third-party scrutiny arrives before the pilot does
Cloud hosting holds workspace evidence and supplied credentials. For customer hosting, a control that runs on your own infrastructure, holds no standing broad credential into your stack and sends the vendor nothing is a materially shorter review than a hosted control plane. The counterweight is equally real: there is no certification to hand the same reviewer. - 03
You will not stay on one model provider
Six upstreams are first-class, and policy equivalence across them is enforced by a table-driven test over every provider kind, because a rule that fires on one provider and not another is worse than no rule at all.
- 01
We already run an LLM gateway with quotas, budgets and cost dashboards.
Then keep it. Provider routing, retries, caching, quotas and cost dashboards are table stakes rather than the lead story, and the posture is to integrate above or beside a gateway rather than compete on connectivity. A gateway carries the request. What it does not carry is proof that the delegated authority and the resulting business effect stayed legitimate: that the refund was approved by a named person against that precise payload, that it dispatched once, and that a pinned verifier then observed the ledger reach the expected state.
- 02
Can you prove the payment happened, or only that you allowed it?
It can prove the run reached a verified terminal state, which is stronger than allowed and weaker than settled. A contract binds pinned action and verifier tools, an idempotency key pointer, postcondition queries with a bounded evidence age, invariants and failure conditions. Stale or exhausted evidence never advances a terminal success state. The limits: durable at-most-one intent rather than distributed exactly-once, and a pinned verifier is not independent attestation.
- 03
Our third-party risk team will require SOC 2 and a penetration test.
Cloud hosting holds workspace evidence and supplied credentials. For customer hosting, neither exists today. What exists instead is a shorter review surface and permission to test it yourself. The product runs on your infrastructure and sends the vendor nothing, checkable in five minutes with two greps and an egress watch rather than a questionnaire. It holds no standing broad credential into your stack, with two pull connectors as the named exception: GitHub Copilot and Cisco Umbrella, each on a read-scoped credential you supply and can withhold. A named date for the certification milestone your process requires is something an agreement can carry.
Cloud custody and optional customer-hosted controls are described separately. The 24 limits we publish, and the 9 risks a named person has to accept in writing, are on one page.
What we do not claimA governed refund, end to end.
The reference case is deliberately mundane, because a mundane action with money attached is where the evidence problem bites. The agent proposes a refund. The policy matching that tool requires a human rather than refusing, so the caller gets its provider's own error envelope carrying a typed code, the approval id and the single-use header to resume with. The approval is bound to that payload hash.
If the tool is pinned as effect-required, it cannot execute raw without an active valid contract, and dispatch is leader-owned with a durable encrypted recovery context, so an ambiguous outcome recovers by verifying rather than by retrying. What you hand somebody afterwards is the trace, the approval, the audit entries and, where a signing key is configured, a canonical Ed25519 effect receipt verifiable offline.
- Compensation is verified, not assumed
- After the compensating call the run stays compensation-verifying until fresh evidence matches every compensation postcondition. Partial execution and failed compensation are visible terminal states.
- Business-key uniqueness
- Scoped by a keyed digest across agents and contract revisions, so two agents cannot both act on the same business event under different identifiers.
For traffic routed through the gateway, configured policies can allow, redact, hold or block a request. Detection is heuristic and can miss sensitive data or misclassify a payload.
The request passes the configured checks and proceeds to its provider. Its trace records the policy decision.
A configured rule matches a value and masks or tokenises it before forwarding the payload to the provider. Unmatched values can still pass through.
A policy requires human approval. The approval binds to this payload, expires and can be used once; the caller receives a typed refusal with the approval identifier.
The gateway denies the routed request and records the blocking policy and outcome in its trace.
Shadow mode records policy decisions without changing the request. Review false positives and missed detections before enforcing the policy on live traffic.
Start the review with the data flow.
Cloud hosting holds workspace evidence and supplied credentials. For customer hosting, there is no vendor-operated component in the path and no telemetry; state lives in one database on your disk; egress goes only to the providers, tool servers, webhook receivers, identity provider and anchor sink you configured. Supplying the software does not itself create a processing relationship, while counsel still decides the roles created by evaluation and support.
The integration direction is a security argument as much as a product one. Token Observe holds no standing broad credential into your security stack: your SIEM, proxy and gateway push evidence to it, so the worst a compromised install can do to your SIEM is stop receiving from it. The exception is named rather than implied: two scheduled pull connectors hold vendor credentials you supply, GitHub Copilot and Cisco Umbrella, both read-scoped and off until you set them.
This is what does the work.
Questions
What is the buying trigger here?
A consequential, externally observable action somebody will later have to prove: a refund, a deployment, a ticket transition, a database update. The definition of done is the sentence a regulated firm recognises immediately: the action cannot be reported complete solely because an API returned success. If your agents only draft text for a human to send, effect contracts are not yet earning their keep.
How are budgets enforced, and what happens to an unpriced model?
Hard circuit breakers per agent by request, hour, day and month, with a kill switch above them. The sharp edge is metering rather than the ceiling: a model with no price row meters at zero, so an agent carrying any budget field is refused before egress when its target, or any reachable fallback, has no price. Without that rule an unmetered estate and an idle one look identical.
Can an agent escalate its own authority by asking another agent?
No. Permissions are action-level and deny-by-default, explicit denies win, and delegation chains intersect permissions at every hop, so agent A cannot obtain, by asking higher-privileged agent B, the thing A was refused. A forged chain can only narrow authority, never widen it. Tool calls re-check grants independently of listing, so seeing a tool is not being granted it.
Bring the objection that is not on this page.
Create a cloud account and workspace. No card or server installation. Model calls and Google BigQuery scans can incur separate provider charges.