Let AI do more. Without doing too much.
Give AI real authority in production. Your rules, approvals where they matter, every action audited—enforced by the platform, not by the prompt.
- No credit card
- Bring your own model
- Every action audited
Arbiter — Acme Support
support-agent · trusted: falseYou
Refund order #1082 for Barbara — she got the damaged unit. Then email her the receipt.Arbiter
Planning 3 steps…orders.read({ id: 1082 })
completedlow risk — orders:read granted to this role
payments.refund({ order: 1082, amount: 42.50 })
completedhigh risk — approval required before it runs
Run halted.
payments.refund · $42.50 — high risk, waiting on a human
Approved by dana@acme.com
run resumed where it stopped
email.send({ to: 'barbara@…', template: 'receipt' })
completedlow risk — email:send granted to this role
Arbiter
Writing the summary…Arbiter
Refunded $42.50 and emailed Barbara the receipt. One step needed you — the rest was already allowed.Refund order #1082 for Barbara — she got the damaged unit. Then e
Watch the halt: a live agent run is safely stopped, approved by a human, and resumed.
- Deny by default
- Every action recorded
- Your model, your keys
- Encrypted at rest
- Read our security posture
Instruction-based safety is probabilistic.
Infrastructure-enforced safety is deterministic.
Most teams have already moved past trusting the prompt. The question worth asking is what a tool allowlist still cannot do for you.
| Capability | A system prompt | A tool allowlist | Authoric |
|---|---|---|---|
| Who enforces it | The model, if it complies | Your gateway, per call | The runtime, every action |
| When the model is wrong | You find out afterwards | The call is refused | The run pauses and waits for a person |
| Governs the arguments, not just the tool | Nothing is enforced | Refund is allowed, or it isn't | Refund up to $5,000 is a policy |
| Revoke a capability | Edit the prompt and hope | Takes effect on the next call | The tool leaves the toolbox |
| Record of what happened | Whatever you logged yourself | A log of calls | Every action, attributed to a principal |
| Covers third-party tools | No | One gateway at a time | Same policy, same halt, same audit row |
A system prompt
- Who enforces it
- The model, if it complies
- When the model is wrong
- You find out afterwards
- Governs the arguments, not just the tool
- Nothing is enforced
- Revoke a capability
- Edit the prompt and hope
- Record of what happened
- Whatever you logged yourself
- Covers third-party tools
- No
A tool allowlist
- Who enforces it
- Your gateway, per call
- When the model is wrong
- The call is refused
- Governs the arguments, not just the tool
- Refund is allowed, or it isn't
- Revoke a capability
- Takes effect on the next call
- Record of what happened
- A log of calls
- Covers third-party tools
- One gateway at a time
Authoric
- Who enforces it
- The runtime, every action
- When the model is wrong
- The run pauses and waits for a person
- Governs the arguments, not just the tool
- Refund up to $5,000 is a policy
- Revoke a capability
- The tool leaves the toolbox
- Record of what happened
- Every action, attributed to a principal
- Covers third-party tools
- Same policy, same halt, same audit row
The safety model
Every action runs through the same rules.
People, services, and AI agents are all just principals. There is no separate AI path that skips the checks — which means there is nothing for an agent to escape to.
Your team
session · role: admin
Your services
api key · scoped
Your AI agents
trusted: false · role-bound
An agent is just another principal. No special path, nothing to escape.
One gate — every request
Authenticate
Session, API key, or agent key — every caller is identified.
Authorize
Declarative policies decide the action, down to the field.
Approve
High-risk actions pause for a human before they run.
Redact
Secret columns never leave the server unmasked.
Audit
Every action lands in the same queryable trail.
Your production
An isolated database per app — never client-facing.
In practice
What governing it actually looks like.
Two documents and one SDK call. Nothing here is a diagram of how it could work — it is the shape of the real thing, and you can read all of it in under a minute.
01
The rule
A policy decides what an agent may do; the table config decides what it may see and what it has to ask about first. Neither one is code.
- payments:create is not denied here — it is absent, and absent is denied
- Redacted columns are stripped before the model ever receives the row
- Risk is graded per operation, so routine work still runs unattended
// The role's policy. Deny by default; every grant is explicit.
{
"version": "1.0",
"defaultEffect": "deny",
"actions": {
"vendors:read_list": [{ "effect": "allow", "priority": 100 }],
"invoices:read_list": [{ "effect": "allow", "priority": 100 }],
"invoices:update": [{ "effect": "allow", "priority": 100 }]
}
}
// The vendors table. Bank details never reach the model at all, and
// updating a vendor keeps the default risk — so it stops for a human.
{
"redactColumns": ["bank_account_number", "bank_routing_number"]
}
// The invoices table. Marking one received is routine bookkeeping,
// declared low so it runs unattended. Money and identity still stop.
{
"agentRisk": { "update": "low" }
}This is the real configuration behind the demo above — a graded ladder, not a blanket block. Because the rule is data, revoking it revokes the capability: the tool leaves the agent's toolbox rather than staying in it and failing.
02
The code
Server-side handlers run under a frozen capability manifest. The two things hardest to get right by hand are the two things you do not write by hand.
- A halt is one call — it pauses the run and resumes on the same line
- The approver sees the real arguments, not a summary to trust
- sdk.sql binds every value; concatenated SQL never reaches production
// Ask a human before the money moves. The run pauses here and
// resumes on this exact line once someone decides.
const approval = await sdk.awaitApproval({
key: `payment:${data.invoiceId}`,
requestType: "payment.issue",
reason: `Pay invoice ${data.invoiceId} to ${vendor.name}`,
requestData: { invoiceId: data.invoiceId, amount: data.amount },
resumeData: { step: "issue" },
});
if (!approval.approved) {
return { status: "held", decision: approval.status };
}
// Every interpolation binds as a parameter. Building SQL by
// concatenation is refused when you save the handler.
const [invoice] = await sdk.sql`
SELECT * FROM invoices WHERE id = ${data.invoiceId}
`;Approvals and injection-safety are primitives, not patterns you have to remember on the day you are shipping fast.
One catalog, two doors
Call the tool, or state the goal.
The same governed capabilities serve a strict door and a loose one. Deterministic when you want control, intent-driven when you want speed — same tools, same policies, same audit trail.
The strict door
POST /acme-support/mcp{
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"name": "orders_update",
"arguments": {
"id": 1082,
"data": { "status": "refunded" }
}
}
}A native MCP server, minus the open pipe: discovery is scoped to the caller's policy and every call is authorized — with the same approval halt.
The loose door
intent → governed runconst agent = app.agent({ apiKey: "plak_live_…" });
await agent.msg(
"Refund order #1082, then email Barbara the receipt."
);
// → reads the order, halts on payments.refund,
// resumes after human approval — same railsState the goal and the orchestrator picks the tools, fills the schemas, and runs them — governed by construction. The caller never learns your API.
The console
Run agentic workflows from one command center.
Not mockups — these are live screenshots of an Authoric workspace: the inbox where risky actions wait for a human, and the agents doing the work.
The approval inbox
Risky actions wait for a human.
When an agent reaches for something your policy marks risky, the run pauses and the action lands here — the exact arguments, the agent's reasoning, and the risk level in plain sight. Approve and the run resumes where it stopped.
- Risk levels set by your policy, not the model
- The real payload, not a summary you have to trust
- Approve, reject, or stop the run outright
The agents
Two agents. One may ask. One may not.
AP Assistant can issue a payment, but has to ask first. Vendor Analyst cannot issue one at all — not because a toggle is off, but because the grant does not exist in the role it is bound to. Capability is derived from policy, so revoking the policy removes the tool.
- Toolbox derived from bound roles, not configured per agent
- Bring your own LLM connection
- Delegation between agents, each under its own policy
Where it matters
Built for the systems you can't be wrong about.
AI is easy to allow where mistakes are cheap. These are the places it isn't — and the reason the halt is the feature rather than the caveat.
Healthcare
Patient data an agent can help with, but never leak.
An intake agent reads and summarises records all day. The columns that identify a patient are stripped before the model ever receives the row, and any write to a clinical record stops for a clinician.
Always pauses: Writes to a clinical record
Financial operations
Reconcile freely. Pause before the money moves.
An AP agent matches invoices to purchase orders and drafts payments unattended. Two things it cannot finish alone: issuing a payment, and changing a vendor's bank details — the quiet one that business email compromise relies on.
Always pauses: Payments and bank-detail changes
B2B SaaS
One agent, many tenants, no cross-contamination.
Support and ops agents work across every customer you serve. Isolation is enforced by the runtime evaluating the acting principal, not by an agent remembering which tenant it is currently reasoning about.
Always pauses: Anything reaching outside the acting org
Born governed
Built for the moment AI is wrong.
Most platforms are built for the happy path. Authoric is engineered around the other one — the moment an agent tries something it shouldn't.
Agents are principals
An agent gets roles and policies just like your people — trusted: false, no special path. What it may do is a dial you set, not a hope.
Human-in-the-loop approvals
High-risk actions pause mid-run and wait in an approval inbox. Approve, and the run resumes exactly where it stopped.
A real policy engine
Declarative policies decide every request — role, ownership, org, time window — with field-level filtering. The database is never client-facing.
Tools derived from policy
An agent's toolbox is computed from what its roles grant. Revoke the policy and the tool disappears — nothing extra to configure or forget.
Governed functions
Server code runs under a frozen capability manifest with an auto-parameterized SQL wall — and a dry-run mode that shows what it would do first.
Governed realtime
Every streamed event is re-checked against the subscriber's own policy and column redactions before it leaves the server. Revocation applies mid-stream.
AI on your own rows
Classify, extract, and search your data by meaning — through the same policy and redaction wall as every other read. A column can't be derived from one you've redacted, and a person's correction is never overwritten by a model.
The runtime
Everything you expect from a backend. Plus the part nobody else has.
Governance isn't a proxy bolted in front of someone else's stack — it's enforced inside a complete, multi-tenant backend. All of this is here, and all of it is documented.
A database per app
True isolation — every app gets its own database, provisioned local, RDS, or Aurora.
Read the docsInstant APIs
Every table ships a governed REST API with filters, pagination, and idempotent writes.
Read the docsFunctions
Custom endpoints in Node or sandboxed Deno, with transactions and approvals in the SDK.
Read the docsAuth & RBAC
Sessions, API keys, roles, and orgs — one identity model for people, services, and agents.
Read the docsRealtime
Live data subscriptions with per-event policy checks and replay on reconnect.
Read the docsStorage
Provision multiple buckets per app — governed and audited like everything else.
Read the docsBilling primitives
Stripe plans, versioned catalogs, add-ons, entitlements, and usage limits — built in.
Read the docsRoles & permissions
Org-aware roles, API keys, and bindings — administered in the console or over the API.
Read the docs
Straight answers
The questions you were going to ask anyway.
Including the one most vendors leave off the page.
Isn't this just row-level security?
Row-level security decides which rows a query returns, and Authoric covers that ground too. It was never meant to cover the rest: holding a run open while a human decides, governing a value rather than a row, or attributing every action to the principal that took it. And RLS governs your database — a large share of the actions worth fearing happen in someone else's tool.
Can't I do this with a system prompt and a tool allowlist?
Not with the prompt — a guardrail written in a prompt is a request, and every public incident of an agent destroying production began with an instruction it was supposed to follow. An allowlist gets you meaningfully further; it really does refuse a call it does not recognise. What it cannot do is pause a run for a person, govern “refund up to $5,000” rather than “may refund”, or leave a record an auditor will accept.
Can't I just give the agent its own account?
Yes — and you should. But an account settles who the agent is, not what it may do. Whatever tool you create it in hands it that tool’s coarse roles: your bot’s payments login holds the entire refund API, not “refunds under $500, on orders this workflow opened”. Ten bot accounts across ten tools is then ten places to audit and ten places to remember to revoke. Here the agent is a principal in the same policy engine as your people, so the unit is the grant rather than the account — one place to see what it may do, and one place to take it away.
Do I have to move my data or rewrite my agent?
No. Point an agent you already run — Claude, Cursor, something in-house — at Authoric over MCP, and its calls go through the same policy checks, the same approval halt, and the same audit trail as everything else. No migration and no data move. Building directly on the platform gets you more, but that is a decision for later, not a precondition.
Which models can I use?
Yours. Connect your own Anthropic or OpenAI key and your agents run on your model under your policies. We never resell tokens and never mark them up, which also means your usage stays a matter between you and your provider.
What happens when the agent is wrong?
That is the case the platform is designed around rather than the one it hopes to avoid. Low-risk work runs unattended. Anything above it stops mid-run and waits in an approval inbox showing the exact arguments it intended to use — approve and the run resumes on the line it stopped at, reject and it does not. If the policy never granted the capability there is nothing to approve: it is refused outright, and no amount of persuading the model changes that.
Are you SOC 2 or HIPAA compliant?
No. We hold no certification today and would rather say so plainly than imply otherwise. What does exist is the substance those audits examine: deny-by-default authorization, approvals on high-risk actions, an audit trail attributing every action to a principal, encryption at rest, and model keys that stay yours. Our security page lists what we enforce and — first — what we do not have, so you can rule us in or out in a minute rather than in a third meeting. We are building toward the certifications and will not claim them before we have them.
Getting started
Your first governed workflow, in an afternoon.
01
Define the rails
Create your tables, roles, and policies in the console — what each principal may touch, and which actions need a human.
02
Connect your model
Bring your own Anthropic or OpenAI key. Your agents run on your model, under your policies — we never resell your tokens.
03
Put agents to work
Drive them by chat, API, or MCP. Every action is checked, redacted, logged — and when it matters, halted for approval.
"Your agent will surprise you. The only question is whether that ends in an approval — or an incident."