Control
Every agent stops. Until it has earned its way out.
Nothing releases cash, commits spend or touches a customer without a person saying so. That is not a disclaimer bolted on at the end. It decides what gets built, and it is the reason a controller will sign.
A queue, not a confirmation dialog.
The version people picture is a modal that asks are you sure. Nobody reads the fortieth one of the morning, and an approval that is always granted is not a control.
The work is already done
The agent has pulled the records, scored them, drafted the action and matched the evidence. What it has not done is send, post or pay.
The evidence sits with the action
Each row shows what the agent read to decide, what it produced, and what changes if it goes through. Approving without opening anything else is the normal case.
Release in batches, reject individually
A dialog asks are you sure. A queue asks which of these forty is wrong. Only the second question is answerable at volume.
The gate is the last control, not the only one.
If the approval queue is the only thing standing between an agent and your ledger, the design is already wrong. Most of what stops an agent should stop it before a person is involved.
01
Scope
The agent authenticates as itself against your directory and can reach only what its scopes allow. It cannot act outside them, whatever it decides.
02
Policy
Value thresholds, counterparty rules, calling windows and segregation of duties are encoded as rules the agent cannot switch off, not as instructions it is asked to follow.
03
Confidence
An agent that is not sure stops and says why. Uncertainty routes to a person rather than resolving itself into a plausible answer.
04
Evaluation
Changes run against historic transactions before they reach production, so a regression is caught by the harness rather than by the queue.
05
Audit
Every action, its evidence, its approver and its timestamp, written to be read by an auditor. The trail exists before anyone asks for it.
What earns an agent out of a gate.
Gates are not permanent, and treating them as permanent is its own failure. It is a decision made on evidence, by category, by you.
- A release rate that has held for months, not weeks, on that category of action
- Corrections that are traceable to a cause you have fixed, rather than to judgment
- An evaluation suite that catches the failure you are worried about, demonstrated on real history
- A rollback path that has been used at least once, deliberately, in a rehearsal
None of that is our call. We show you the numbers and the failure modes; you decide which categories run without a person and which never will.
Most operations end up blended.
Not fully gated, and not fully autonomous. The categories that have proved themselves run end to end, and the exceptions, which is where the judgment was always needed, stop at a person.
Runs end to end
- Matched, in tolerance, and inside policy
- Counterparty and value profile already seen many times
- Sampled after the fact rather than approved before it
Stops at a person
- Anything outside tolerance or policy
- New counterparty, or a value the category has not seen
- The agent's own uncertainty, surfaced rather than resolved
- Anything that releases cash, commits spend or reaches a customer for the first time
The ratio is the number worth watching. It tells you how much of the work has genuinely moved, and it is the honest version of a capacity claim.
Bring us one workflow.
Thirty minutes, no deck. Pick the process that costs you most in people, errors or delay, and we'll pressure-test whether an agent is genuinely the right answer for it.
- An honest read on whether that workflow is a good agent candidate
- What the first deployment would involve, and roughly what it costs
- An honest answer if the sequencing is wrong and you should fix something else first