AI agent governance + security
Control what AI agents can do.
Prove what they did.
ApexClaw governs AI agents and autonomous workflows before execution — verifying identity and authority, enforcing deterministic policy and limits, requiring human approval when necessary, controlling execution, and producing verifiable evidence of what occurred.
How a governed action is decided
Every request passes through identity, authority and deterministic policy before any decision is taken, and produces signed evidence that can be verified independently afterwards.
- payment.send · vendor_a · 42.00 USD. Decision: ALLOW. Within the automatic limit, permitted destination. Executed once. Receipt signed.
- payment.send · payroll_pool · 2,500.00 USD. Decision: HOLD. Above the automatic limit. No effect until a human approves. Held, then released once by a named approver.
- payment.send · sanctioned_x · 60.00 USD. Decision: DENY. Destination is prohibited by the active policy version. No effect. The refusal is itself signed evidence.
- Pre-Execution Authorization
- Human Oversight
- Agent Identity
- Deterministic Policy
- Revocation
- MCP Security
- Execution Limits
- Signed Evidence
- Independent Verification
- Recovery
Why ApexClaw
Observability tells you what an agent did. ApexClaw determines whether it is authorized to do it — before execution.
Monitoring, guardrails and after-the-fact logging all describe a decision that has already been made. Pre-execution governance is the decision itself: identity, authority, policy, approval and hard limits applied in the same transaction that commits the action.
After the fact
Monitoring, guardrails, logging
- Describes an action that already happened
- A model or heuristic decides what looked acceptable
- Logs can be written by whatever wrote the action
- Stopping a bad action depends on noticing it in time
Before it happens
Pre-execution governance
- Authority is checked before the action is transmitted
- Deterministic rules over a versioned policy, not judgement
- Evidence is signed by a key the writer cannot forge alone
- A prohibited action produces no effect at all
Architecture
A governed execution core, and six capability layers
The core decides and executes. Each pack adds one governance capability on top of it, with its own acceptance evidence. These are security and governance layers, not product tiers.
Foundation
ApexClaw Governed Execution Core
Authenticates the caller, decides against the active policy inside the write transaction, consumes approvals, reserves limits, executes exactly once through a capability the agent never holds, and signs every step into a hash-linked chain.
- Identity
- Authority
- Policy
- Decision
- Human approval
- Execution
- Signed evidence
- Independent verification
Governed Execution
The end-to-end governed action: automatic allow within limits, a hold that produces no effect until approved, a hard deny, and exactly one execution — demonstrated from a shipped artifact rather than a development tree.
Revocation & Audit Evidence
An authorized operator revokes an agent. Its next request cannot execute, and an action already approved but not yet dispatched cannot execute either. The revocation and its consequences are signed audit evidence.
MCP Governance & Bypass Resistance
One MCP tool reaches one governed action. Altered arguments, replay, forged identity arguments, revoked authority and direct execution attempts all fail correctly, with the tool's provenance signed inside the envelope.
Operational Durability, Recovery & Daily-Operation Proof
Sustained load, replay storms, concurrent approvals, process kills at the two documented windows, an undeterminable outcome, an evidence-protection outage, a policy change under activity and repeated restarts — with no unauthorized and no duplicate effects.
External Trust Checkpoints & Independent Trust Domain
Checkpoints anchored outside the administrative domain that produced the evidence, so completeness can be established against a party the writer does not control.
EU AI Governance & Compliance Evidence
A requirement-by-requirement map from EU AI Act obligations to the specific technical control and the specific evidence object that supports it, stating coverage and stating gaps.
Verdicts use a fixed vocabulary and are reviewed on a stated date. Candidate means built and passing its own gate, not independently accepted. Planned means nothing has been demonstrated. See how every claim on this site is governed.
Security and proof
Evidence a reader can check without asking us
Every governed action leaves a signed, hash-linked record. The record is verified by a portable verifier with no database, no signing key, no network and no product installation on the path — and deliberately altered evidence is refused for a stated cryptographic reason.
Signed, hash-linked evidence
ProvenEach decision, authorization, outcome, refusal and configuration change is written as a signed record in a hash-linked chain. The record carries the request identity, the policy version, the decision, the approver where one exists, timestamps and the execution result.
Offline independent verification
ProvenEvidence is verified by a portable verifier with no database, no signing key, no network and no product installation on the path. Deliberately altered evidence — an edited amount inside a signed body, a stripped signature, a broken chain link, a checkpoint re-signed by the writer's own key — is refused, and a verifier that cannot run reports an instrument failure rather than a refusal.
Limitation · The verifier was written by the same party as the system it checks. Verifying with it confirms signatures, linkage and key separation; it is not a substitute for an independent implementation of the documented record format.
Checkpoint key separation
ProvenEvidence records and the checkpoints that attest them are signed by different keys held by different service identities. An attacker holding the record-signing key can rebuild a shorter, internally consistent, correctly signed chain and is still detected, because they cannot mint a checkpoint.
Limitation · Different key ids prove key separation. They are not custody. Custody is a deployment fact, reported only when a custody report measured at the deployment is supplied.
Measured service custody
ProvenCustody is measured rather than asserted. Permission probes run as each service account and record the actual uid, gid and supplementary groups of every running process. A probe that could not run is reported as an error and fails the report — it is never read as a control that held.
Limitation · This is one host. An attacker with root on that host defeats the separation. Independence means a second administrative domain, which is what external trust checkpoints address and which is not built.
Evidence protection blocks new execution
ProvenWhere evidence protection is required, a failure of the witness that attests the evidence chain blocks new protected dispatch rather than letting execution continue unwitnessed. Reconciling work that may already have had an effect is never blocked, because refusing to reconcile would leave a real-world action in an unknown state to protect a log.
Unknown outcomes stay unknown
ProvenWhen a request was transmitted but the answer never arrived, the system records the outcome as unresolved and retains the budget. It does not retry blindly and it does not convert an unknown into a failure to make the state tidy. Reconciliation then determines what actually happened.
Global compliance
Mapped to the frameworks your auditors already use
ApexClaw contributes technical controls and evidence objects against published frameworks. It states control coverage and gaps. It does not claim certification, and no badge on this site represents a third-party assessment.
No certification badge appears on this site, because no third-party certificate exists to display. Where a control is mapped rather than independently assessed, the mapping says so.
Industries
Built for environments where an unauthorized action is not recoverable
Where money moves, where physical systems respond, and where a regulator will later ask who authorized what.
Conformance
An all-green result means nothing unless the checker could have failed
ApexClaw's conformance method records a verdict per check, a controlled cause for every non-verdict, the exact checker and corpus versions, and artifact digests — alongside positive controls and must-fail vectors that prove the instrument bites.
ApexClaw's founder, Julian Joseph, chairs the W3C Agent Conformance and Benchmarking Community Group. Participation in a community group is not endorsement: the W3C does not certify ApexClaw and does not endorse it.
The conformance methodPer-check verdicts
- PASSThe check ran and the property held.
- FAILThe check ran and the property did not hold.
- NOT-EXERCISEDNo vector reached this check. Not a pass.
- INCONCLUSIVEThe check ran and could not decide. A stated cause is required.
- VOIDThe instrument itself failed. Never reported as a result.