Routine actions go through. Risky ones wait for a named person to sign off. Dangerous ones are blocked. Every decision lands in a tamper-evident log built for AI Act Art. 12 and 14.
Replit's AI agent deletes a live production database — during a code freeze it was told to respect
The Register · Jul 2025An AI agent guarding a $47,000 crypto pool is talked into paying all of it out, in one message
Cointelegraph · Nov 2024Asana's MCP server shows ~1,000 customers' data to other organisations for twelve days
BleepingComputer · Jun 2025Risky calls wait for a named person to approve or deny.
Routine calls clear in milliseconds. People only see the exceptions.
Every decision, and who made it, in a tamper-evident log.
OpenAI, Google and Microsoft adopted one open standard for agents to call real tools.
The EU Cloud and AI Development Act, and Poland's sovereignty test for public tech purchases.
Human oversight (Art. 14) and automatic logs (Art. 12) become mandatory. Fines reach €15M or 3% of turnover.
Start with EU insurers, banks and claims firms of 200–3,000 staff that run at least two agents touching a system of record.
SAM: Eurostat, 55,000 EU firms with 250+ staff (2024), 55% of them using AI (2025); Capgemini (2025), 14% of large firms deploying agents, global sample; × €75K, the Growth tier. SOM is our assumption.
Auditors read a hash-chained record and export it. They can't approve anything.
A manager panel, cost and usage by agent and model, and an org chart that decides who sees which agents. Agents and teams, not individual people.
Every tool call is checked through the SDK, the MCP gateway or the Claude Code hook. A CI check does the same for pull requests.
Sample data, real components. Connect once, pick from seven gates, approve only what is held. Live demo on request.
Not metered: a product that ends surprise AI bills shouldn't send one of its own.
Open-core engine, self-hosted
Up to 100K decisions a month
Up to 500K decisions a month
Unlimited, SLA, multi-entity
Annual contracts, so revenue is predictable from the first design partner.
Blended annual contract value: design partners start at €30K and move to Growth at renewal. 6–8 of them reach €400K–€600K ARR within a year of general availability.
More agents and more teams under the same sign-off, not usage creep. Paid tiers add compliance reporting, the evidence export and support.
An engineer self-hosts the open-core engine on their own agents.
BuildThe CISO or internal audit signs a paid pilot, not a full procurement cycle.
ProveManagers put more teams and agents under the same sign-off.
OperateJust told to give an agent write access. The CISO or Head of Internal Audit signs, from a security or compliance budget.
“Who approved this payment, and can you prove it?”
First 6–8 design partners are regulated firms, insurance first. Banks and the public sector follow as EU rules start favouring EU vendors.
| Governs actions | Picks the risky calls itself | Who signs off | Tamper-evident record | Under EU law | |
|---|---|---|---|---|---|
| Filter wordsBedrock · Azure Content Safety · Model Armor · Lakera | words only | — | — | — | — |
| Block actionsWitnessAI · Operant AI | ✓ | ✓ | — | — | US |
| Zenity | ✓ | ✓ | — | — | Israel |
| Veto | ✓ | ✓ | — | — | self-host |
| Invariant (Snyk) · Lasso | ✓ | by hand | — | — | self-host |
| Ask a personHumanLayer | ✓ | by hand | a reviewer | — | US |
| Auth0 for AI Agents | ✓ | by hand | the user | — | US |
| Permit.io · Frontegg AgentLink | ✓ | by hand | a reviewer | — | Israel |
| Inlock | ✓ | ✓ | ✓ named person | ✓ hash-chained | ✓ EU |
Vendors' own material, Sept–Oct 2026; — means not stated. HumanLayer, Permit.io and Frontegg log decisions but don't call the log tamper-evident. Auth0 asks the agent's own user, not a second person.
Security tools stop attacks. We run the sign-off. Snyk or a platform can sit alongside us: a fleet mixes vendors, and an auditor wants one independent record.
The engine picks the risky calls, a named person signs them off, and the record verifies itself. Security tools are built to stop attacks, not to run the sign-off.
The plan: an EU entity, EU hosting and EU inference, so the whole stack sits out of CLOUD Act reach. A US vendor can't match it without a new legal entity.
Buyers can read and run the engine before they pay. A regulated buyer's security review starts from code, not a sales deck.
WitnessAI starts at 1,000 users. A 300-person insurer running forty agents is too small to buy it.
Alight and Travelers will try the sandbox. No EU prospect or signed deal yet: this round buys the first design partners. Next: ten calls with EU insurers and banks. Which agent can write to a system of record, who signs it off today, and does any tool they own cover it?
What a reviewer sees: a payout and a bank-detail change wait for a person, a DROP TABLE is blocked, the rest go through in under a millisecond.
Roman Belfer, Founder
Poland, EU
Director of Engineering at Travelers, a Fortune 500 company and the 6th-largest US P&C insurer. Led its modernisation and security programmes.
CTO at EyreACT, an EU AI Act governance platform, building compliance tooling before the rules made it urgent.
Piloted AI-guardrailed CI/CD checks at Travelers that caught AI-written code breaking business logic.
First close at €400K funds the founder and a founding engineer. A second close at €550K adds a platform and security engineer. The full €700K adds a solutions engineer, the audit and paid pilots.
ContactRoman Belfer · linkedin.com/in/roman-belfer