Prove what your AI agent was allowed to do.

You sign a mandate with a passkey: budget, who it may write to, what data stays closed. A witness judges every action against it and keeps a signed record anyone can check offline.

Create account Try in 10 minutes

Free during preview. Preview software: not a finished product, no uptime promise.

The problem

Agents now send mail, spend money, delete and publish for people. When one goes wrong, the only record is usually the log of the party being judged.

Reports exist of agents deleting a production database or buying without confirmation (as published by third parties; we did not reproduce them).

After an incident someone else (a court, an insurer, a card network) needs proof of what the agent was allowed to do.

How it works

Sign in with a passkey
No password. Works on a laptop, or on a phone through a QR code.
Create an agent
You get an API key, shown once, and a one-line config for your MCP client.
Sign a mandate
Fill in a plain form. Your browser shows exactly what is signed, and your passkey signs it.
Watch and decide
Each action is allowed, denied or held for you. Held actions wait for your passkey approval. Download an evidence pack and verify it offline.

Pricing

Free during preview, paid plans soon. Preview limits: 3 agents and 5000 actions per day per account. No prices are set yet.

Honest limits

The demo attacks are scripted. They show that the gateway and the witness enforce the mandate, not how often real agents are fooled.
Closed-data checks are plain literal matching. A paraphrase gets past them; the recipient rules are the stronger line.
Whether a delete is reversible is declared by a catalogue you control, not by the agent. A wrong catalogue means a wrong decision.
The witness is as independent as its operator. In this preview the operator is us.
Your passkey device does not display the mandate. You see it on this web page, so you trust the page scripts. They are plain files without a build step, and their SHA-256 hashes are below.
We register your key on our own site (no device attestation), so a key swap at registration would not be detected.
Only actions that go through the gateway are covered. An agent with other channels is out of scope.
The specification and implementations have not been reviewed by outside parties.

Page script hashes

SHA-256 of the files that encode and sign your mandate. Compare them with shasum -a 256 on what your browser loads.