Runtime control layer
Authority for autonomous agents.
Mandates finds every agent and non-human identity in your stack, ties each to the human accountable for it, and checks intent before each tool call runs. When intent drifts, it cuts the session in under 30ms.
< 30ms containment // target latency
00:00.000IN agent:feedback-summarizer · task: summarize queue
00:00.004MCP middleware → intent graph
00:00.011evaluate: external data transfer outside mandate
00:00.019credential scope: customer email read
00:00.027BLOCK · terminate session
tool call never executed
A session, stopped before it runs.
(01) — The interceptorAgent request
An agent issues a tool call. The request meets the control boundary before execution.
MCP middleware
An inline interceptor captures the request payload and routes it for evaluation.
Intent graph
The intent engine evaluates the action against the agent’s mandate and context.
Enforce decision
Allow, block, strip a key, or terminate the session before the tool runs.
Identity says who. Mandates says what.
A valid identity is not a safe action. Mandates governs agent behavior at execution time, call by call.
Find shadow agents
Map agents and non-human identities across code repositories, cloud IAM, and MCP connections.
Tie to a human
Bind every agent and service credential to the person accountable for its actions.
Cut the drift
Check intent before every tool call and end the session when behavior leaves its mandate.
A layer that sits in the path of every call.
Mandates intercepts requests at the MCP boundary. Its intent engine evaluates the action before execution, then returns an enforcement decision inline.
Designed for read-only discovery and lightweight framework hooks across the agent stack.
Inspect a proposed action.
Compare a proposed agent tool call against a policy. This AI assessment is for review only; it does not enforce policy or execute the call. Avoid pasting secrets or sensitive data.