Governance plane for AI agents

Pre-execution rule-check. Tamper-evident audit. Kill-switch — in front of every agent you ship.

Cautel is the governance layer that sits above the AI agents and autonomous systems already running inside your enterprise. It does not replace them — it watches every action they attempt, checks it against the rules your risk and compliance teams define, and either approves, blocks, pauses, or kills. The reason: the EU AI Act, your auditors, and your board will not let you ship agents you cannot trace, override, or stop.

Talk to usSee pricingSee the architecture

We reply to cautel@polsia.app within one business day.

  • EU AI Act (GPAI)
  • NIST AI RMF
  • ISO/IEC 42001
  • SOC 2 Type II

cautel / decision-stream · tenant acme / eu-west-1

live
  • 14:02:18.412
    refund-bot
    POST /refunds amount=$340 currency=USD
    policy: refund < $500 → auto-approve
    allow
  • 14:02:20.901
    outreach-bot
    send_email(to=m.li@… segment=Q3-prospect)
    policy: forbidden segment → block [mat:§4.2]
    block
  • 14:02:33.077
    sql-agent
    UPDATE customers SET pii_hash=… WHERE id=9921
    policy: write outside allow-list → human review
    pause
  • 14:02:47.220
    scraper-3
    GET /v1/listings?page=… (cost += $214)
    kill: cumulative_cost > $50,000 / hr
    kill
POST /cautel/decisionp99 4.1 ms · 99.99% uptime SLO

Why teams are stuck between pilot and production

The thing that gates your agents going live is not capability — it is accountability.

The blockers, in one sentence each

  • EU AI Act GPAI and autonomous-agent obligations land in August 2026.
  • Auditors and the board want traceability you can hand over — not reconstructed SIEM fragments.
  • You already have agents in pilot; production is gated on human override + kill control.

Why today’s ad-hoc stack falls short

Prompt logs
Streaming output, not the decision that produced it.
RBAC only
Authenticates the user, not what the agent decided to do.
SIEM stitched in
Indexing fragments. No rule, no verdict, no override.

Cautel is the agentic control plane regulators and the Cloud Security Alliance are pointing toward — built today, drop-in, and already mapping to GPAI obligations.

How it works

One gateway in front of every agent. One decision — approve, block, pause, or kill — before a single side effect.

Cautel is a drop-in HTTP gateway your agents call instead of calling tools directly. The gateway returns the verdict your agents act on. Rules are version-controlled; verdicts are audit rows. You do not replace your agents, your orchestrator, or your model layer.

01

Agent proposes

Every tool call, retrieval, or side-effect goes through Cautel.

02

Cautel decides

Rules + context + anomaly score → approve · block · pause · kill.

03

Auditor reads

Every decision lands as a hash-chained row, signable on demand.

POST /cautel/decision · agent=<id> · action=<tool:call> · rules_version=v…

What you get on day one

Capabilities your security, risk, and platform teams will actually use — not a checklist of agent features you already have.

01
Pre-execution checkpoint
Wrap any agent — Temporal worker, LangGraph, custom MCP server, in-house orchestration — behind a single gateway. Every action hits Cautel before it runs.

POST /cautel/decision

{
  "agent": "refund-bot",
  "action": { "tool": "refund.create", "amount": 340 },
  "context": { "tenant": "acme", "user": "u_8821" }
}
→ 200 { "verdict": "allow", "rule": "refund<500", "audit_id": "0x9c4e…" }
02
Human-defined rule engine
Codify what each agent may, must, and must-not do. Rules from policy, contracts, and the regulator — written once, applied to every agent call.
03
Tamper-evident audit
Every decision — approved, blocked, paused, killed — logged with its matched rule and a hash chained to the previous record. Hand to a regulator, not a forensics team.
04
Human override, mid-flight
Pause an agent mid-action and route to a reviewer. Resume, revise, or revoke. The override itself becomes an audit row.
05
Anomaly detection
Drift on cost, blast radius, data classes, or call shape — scored in real time, surfaced before it becomes an incident.
06
Sandbox + kill-switch
Sandbox the failing agent and kill it. The same atomic kill applies across your fleet — your last line of defense, not your first.

Tamper-evident, regulator-ready

Every verdict — approve, block, pause, kill — is logged with the rule that decided it, signed and chained.

A Cautel audit row is not a prompt excerpt. It is the decision that was made, the rule that was matched, the human override if any, and a hash chained to the row before it. Ship the chain to the regulator instead of reassembling it after the fact.

  • Append-only ledger, hash-chained per tenant.
  • Verifier CLI ships to your audits team — runs offline.
  • Cross-region residency, EU and US, per customer.
audit/ledger · tenant acme · head 0x9c4e…2bd1
tail · live
One row per agent decision. Verdicts colored: allow · block · pause · kill.
14:02:18.412
refund-bot
POST /refunds amount=$340 currency=USD
policy: refund < $500 → auto-approve
allow
14:02:20.901
outreach-bot
send_email(to=m.li@… segment=Q3-prospect)
policy: forbidden segment → block [mat:§4.2]
block
14:02:33.077
sql-agent
UPDATE customers SET pii_hash=… WHERE id=9921
policy: write outside allow-list → human review
pause
14:02:47.220
scraper-3
GET /v1/listings?page=… (cost += $214)
kill: cumulative_cost > $50,000 / hr
kill
hash ← 0xa1ce…8003 · signed by cautel-gw/eu-west-1
GET /cautel/audit?since=…200 OK · nbf=…

Compliance mapping

The obligations regulators actually ask for, mapped to the Cautel primitives that satisfy them.

Your auditors want to read a column of obligations and remove doubt. The matrix below is the document.

frame 01
EU AI Act — GPAI

  • Art. 50 — transparency to deployers

    ↳ Tamper-evident audit log with rule attached

  • Art. 55 — systemic-risk documentation

    ↳ Decision history replayable per agent

  • Art. 14 — human oversight

    ↳ Pause + override primitives, recorded

  • Art. 73 — serious-incident reporting

    ↳ Kill events export as regulator-ready records

frame 02
NIST AI RMF 1.0

  • GOVERN — accountability

    ↳ Per-agent mandate + signed approver

  • MAP — context & capability

    ↳ Allow/deny action taxonomy

  • MEASURE — continuous monitoring

    ↳ Live verdict stream + anomaly alerts

  • MANAGE — incident response

    ↳ Sandbox + kill + escalation paths

frame 03
ISO/IEC 42001

  • Clause 6 — AI policy

    ↳ Codified as Cautel rules, version-controlled

  • Clause 8 — operational planning

    ↳ Rule hit-rates + drift reports

  • Clause 9 — performance evaluation

    ↳ Quarterly evidence pack exports

  • Annex A — controls

    ↳ Mapped: A.5.2, A.6.2, A.8.4

Questions security & risk teams ask first

Frequently asked, briefly answered.

Anything else — write to cautel@polsia.app.

next step

Ship agents whose every decision is pre-checked, post-logged, and overridable — without rebuilding the agents you already have.

Write to us

cautel@polsia.app

Tell us the agent stack you have today and the first GPAI deadline you are working back from. We will reply within one business day.

Request access