AI agents are starting to run real operations: refunds, records, replies to your customers. Selah is the governance layer that decides what any agent may do and say before it acts, whether it is an agent from a vendor platform, one your company built, or an open-source agent you host yourself. The agent proposes. Our engine resolves your rules. Only a permitted action executes. Which means, for the first time, you can hand an agent real work and trust it: not because the model is perfect, but because the gate is.
A wrong action moves money or data. A wrong response makes a promise no one agreed to. Our platform stands at three moments and returns one of three verdicts at each.
Every incoming message is screened before the agent engages. A fast rule check plus a light model check, so hostile, manipulative, or out of scope input never starts a bad chain.
Posture: fail-open, never blocks a real action on its own.Verdicts: allow, escalate, block.The gate that matters. Before any agent touches money, data, or a system, the proposed action is resolved against your rules. Fully deterministic, no model on the path, a verdict in well under ten milliseconds.
Posture: fail-closed, no permit, no action, ever.Verdicts: permit, hold, deny.Before a reply reaches a person, it is checked against what the agent may say. Banned phrases, required disclaimers, prices that exist in the catalog. Hard rules first, then a model layer for grounding and tone. This is where hallucination stops being a risk: a model may still invent a price, a policy, or a promise, but what is not grounded in your source of truth does not ship.
Posture: hard rules fail-closed, model layer fails open.Verdicts: allow, escalate, block.The rules our engine enforces are Agent Operating Procedures, AOPs: structured, versioned, machine-enforceable statements of what an agent may do and say, and what happens when it steps outside that. They resolve across five layers in fixed precedence, so a universal law, a local regulation, and your own promotion can coexist without ambiguity. A campaign discount can never override a compliance rule. By design, not by hope. Our packs bundle AOPs by industry and jurisdiction so governance is enabled, not rebuilt, for every deployment.
This is how our engine behaves at the moment that matters. The action check returns its verdict before anything changes. Not a log entry discovered the next morning: a wall, hit in under ten milliseconds, while everything within the limit keeps running. The held item lands in the review queue with full context and a plain language summary. A person decides, and our ledger records who and why, append-only and hash-chained, with personal data kept out by architecture.
The agent never holds the keys. It asks. Our engine answers.
Any agent, anyone's agent, emits a structured action. Zero credentials, no power to act alone.
Your AOPs resolve across the five layers, compliance first. Permit, hold, or deny. Deterministic, in under ten milliseconds.
Only a valid permit executes, server side, with credentials the agent never sees. If our engine fails, the action dies.
An agent of this type may refund up to one thousand dollars without a human.
enforced by the AOP Runtime · deterministicAn agent may never quote a price or discount that is not in the loaded catalog.
enforced by the response checkA reply about returns must include the returns disclaimer.
enforced by the response checkIn this jurisdiction, the agent must not collect a certain identifier.
contributed by a compliance packNo one writes rules perfectly on day one. You grow them from your real traffic. This is what our platform does in each phase, and one example of what that looks like.
our engine computes every decision and writes it to your Shadow AOP Ledger without blocking anything, so you see exactly what enforcement would do, on live traffic, at zero risk.
an agent drafts a reply with a 30 percent discount that is not in the catalog. In shadow, the reply still goes out, and the ledger records what our engine would have done: block, off-catalog discount. Nothing was interrupted. Now you know, with evidence from your own traffic.
when the ledger shows our engine deciding the way you want, you turn enforcement on. A deny now stops the action for real, and a hold waits for a person.
the same draft never reaches the customer. The response check blocks it before it sends, the item lands in the review queue, and the ledger shows who decided and why.
Any agent can propose through our gates: the ones your company runs, the ones your product sells to customers, or the one you host yourself. The engine never changes; your tenancy decides where holds land and who reviews them.
Govern the agents your company runs on its own operations. Holds land in your review queue inside our dashboard, and your team decides.
learn moreAI companiesYour product is agents for many businesses. One parent tenant, a sub-tenant per customer, escalations webhooked into your product. We store none of the conversation.
learn morepersonal agentsYou run your own agent, self-hosted or from a vendor. It proposes through our gate and acts only on a permit. The lightest way in.
learn moreOur engine is live. Point any agent at three endpoints, run our shadow mode on real traffic, and turn on enforcement when the ledger proves the rules are right. That is what trusting AI with real work looks like: not hope, a gate and a record.