§ 00 / A checkpoint for AI agent actions
System onlineLet your AI agents act.
Decide what they're allowed to do.
Before an AI agent refunds a customer, emails a file or changes a database, Execlave checks the action against your rules. It allows it, holds it for a person to approve, or blocks it, and records blocked and held actions in a tamper-evident audit trail. Run it as managed cloud or self-hosted.
Free tier. No credit card. Instrument an agent in minutes.
Built for teams that
- run AI agents that can call tools, APIs or databases
- let those agents touch customer data, money or production
- will be asked to prove what an agent did, and who allowed it
Try it: pick an agent
Illustrative scenarios
- 01Support agent wants toRefund $4,800 to order #A-1182A customer says the parcel never arrived.
- 02Execlave checks your rule“Refunds over $500 need a manager to approve”a synchronous decision before the action runs
- 03HOLD · waiting for a personThe support lead gets an approval request. Nothing is refunded until they say yes.
- 04What gets recorded
held · agent=support-bot · rule=refund_limit v2 · approver=pending
Works with
- LangChain
- CrewAI
- OpenAI Agents SDK
- AutoGen
- LlamaIndex
- MCP
Python and TypeScript SDKs · any other framework through enforce_policy()
§ 01 / What it is
Card authorization, for AI agents.
Your bank checks every card payment against your limits before the money moves. Execlave does the same for AI agents: every governed action is checked against your rules before it reaches your systems.
- 01 / Agent asks
Your agent wants to do something
Send an email, issue a refund, query customer records, call an MCP tool. Your code asks Execlave first, with one SDK call.
- 02 / Execlave checks
Your rules decide, not the model
Spending limits, data that must not leave, which tools each agent may use, prompt-injection guards. 19 built-in rule types, managed in a dashboard.
- 03 / You stay in control
Allow, hold or block
AllowHoldBlockHeld actions wait for a person to approve. A kill switch pauses one agent, and its next policy check is blocked. Blocks, holds and approvals land in a hash-chained audit trail.
§ 02 / Who it's for
Three teams, one question: what did the agent do?
Platform, security and GRC teams share the same record of governed agent activity, each with a different question to answer.
02.1
Platform engineering
“We need to ship agents without a six-month security review.”
Add the check in a few lines of Python or TypeScript. Rules live in the dashboard, so security can change them without a redeploy.
Govern agents with your platform team→
02.2
Security
“One poisoned ticket shouldn't be able to export our customer list.”
Apply policy before tool calls reach your systems, review injection, PII and MCP integrity controls, and pause any agent with the kill switch: the next action it asks Execlave about is blocked.
Review controls for security teams→
02.3
GRC and compliance
“When the auditor asks who approved this, we need the answer in minutes.”
Follow decisions and human approvals into tamper-evident evidence you can export for control reviews.
Explore evidence for GRC teams→
§ 03 / The same ticket, twice
A customer ticket tells your support agent to export every customer record.
An AI agent's output can reach your tools, APIs and data directly. Here is the same attack without and with a checkpoint in between.
Without Execlave
- The agent reads the ticket and follows the hidden instruction.
- It calls the export tool. Nothing sits between the agent and the tool.
- Your customer records leave the company.
- Your logs show the call happened, but not whether any rule allowed it.
With Execlave
- The agent tries the same export.
- Execlave runs your prompt-injection guard and data rules before the tool is called.
- The export never runs. The agent gets a refusal instead.
- The block is recorded with the rule, its version and the agent, ready for your auditor.
Be ready for these three auditor questions:
- Q. 01
"Walk me through who is allowed to call which tools, for which agents, and under which conditions."
- Q. 02
"Pull the audit log for every action this agent took on customer data in the last 90 days. I'll wait."
- Q. 03
"Show me the moment a human approved this agent's last 10 high-impact decisions."
Start with the permission, the decision, and the record.
§ 04 / Try it yourself
Type an attack. The real detector decides.
This box sends your text to Execlave's production prompt-injection detector, with the built-in patterns every injection_scan policy starts from. Try to get past it.
Verdict
Type something or pick an example. The verdict appears here.
Prompt-injection check only. Real policies also cover spending limits, PII, tool access and approvals.
§ 05 / By the numbers
Counted from the shipped product
Execlave by the numbers.
§ 06 / Interactive simulation — runs in your browser, fixture data
A browser-only simulation of the checks production agent calls go through: fire a prompt-injection attempt, watch it get blocked, then pull the kill switch and watch new actions stop. Nothing here calls our servers.
Simulated data. In production, violations and admin actions write hash-chained audit records
§ 07 / How it works
From zero to governed in minutes.
Three steps, minutes to ship.
01 / Instrument
Add three lines to add the gate.
Install the SDK, then call enforce_policy() before the protected operation. Blocks, holds, or allows — your policy decides, before the tool runs.
02 / Set rules
Declare what cannot happen.
Define policies: cost limits, model restrictions, content filters, prompt injection guards. Block or warn — your choice.
- cost_limit · $50 / day
- model · gpt-4o | claude-3.5
- block · PII in prompts
- guard · prompt injection
03 / Ship with confidence
Deploy, watch, stop.
Deploy knowing every governed action is checked against policy, blocks and violations land in a hash-chained audit trail, and the kill switch is one click away.
Kill switch
pauses one agent · its next policy check is blocked
§ 08 / Runtime enforcement
Runtime policy enforcement — a gate, not a log.
Every governed action gets a synchronous decision against your policies before it reaches the real world.
// Execution flow with Execlave installed
request ────────▶ decision, before the tool runs
01 / intent
Agent decides to act
e.g. query database
02 / enforcement
Execlave enforcement
policy eval · audit · optional semantic check
synchronous · duration in Server-Timing header
03 / outcomes
- ✓Allowed — proceedsPASS
- ❚❚Paused — human reviewsHOLD
- ✗Blocked — stops hereDENY
04 / record
Audit log entry
hash-chained · signed checkpoints
Where enforcement fits
Enforcement is not logging, and it's not a prompt instruction.
| Capability | Execlave | Logging / observability alone | Prompt-level guardrails alone |
|---|---|---|---|
| Main job | Apply configured policy before a governed action runs | Explain activity, errors, cost, and behavior | Guide model behavior through instructions |
| Stop an unauthorized tool call | Yes — when the call is routed through enforce_policy() | Requires a separate enforcement layer | Instructions alone are not an external authorization boundary |
| Human approval | Policy can hold execution for review | Can capture or surface approval events | Can ask for confirmation, but needs an external workflow to enforce it |
| Audit evidence | Hash-chained audit trail sealed by signed checkpoints | Trace/log evidence; signing varies by implementation | Conversation history — not inherently a signed decision record |
| Best used with | Observability, evals, and tool permissions | Runtime enforcement | Runtime enforcement and evals |
Best results come from combining all three: enforcement at the gate, observability for context, guardrails for model behavior.
§ 09 / AI Agent Management Platform
Beyond enforcement. The full control plane.
Execlave is an AI Agent Management Platform (AMP): the six controls enterprises need to manage autonomous agents in production — available today.
- 01 / Capability
Tiered autonomy governance
Assign every agent an autonomy level — observe, advise, act-with-approval, or autonomous — and auto-apply the recommended policy bundle for that tier. Drift detection flags when an agent outgrows its guardrails.
- 02 / Capability
Cost circuit breaker
Synchronous spend caps per org, agent, user, or workspace across 1m/1h/1d/1mo windows — enforced in the policy path, not reconciled after the bill. Burn-rate alerts fire before a budget is breached.
- 03 / Capability
Agent registry & lifecycle
Inventory every agent with a lifecycle state, immutable version history, diffing, and one-click rollback. Shadow-agent detection surfaces agents calling your API without registration.
- 04 / Capability
Permission-drift detection
Baseline each agent’s tools, data sources, and permissions, then catch privilege escalation, anomalous access to sensitive or PII data, and unused over-privileged permissions.
- 05 / Capability
Eval-to-policy suggestions
Turn detected anomalies, violation patterns, and eval failures into proposed policies with confidence scoring. Accept, modify-and-accept, or reject — nothing is ever auto-enforced.
- 06 / Capability
Data-access lineage
Record what classes of data — public, internal, confidential, PII, PHI, PCI — each agent touched, with an auto-classifier, GDPR subject-access queries, and PII-by-agent reporting.
§ 10 / Evidence
Answer an auditor with the decision and its evidence.
Execlave records blocks, policy violations, and admin actions in a hash-chained, append-only audit trail sealed by cryptographically signed checkpoints. Use that evidence to investigate activity and support control reviews.
01 / Permission
Which agent could request which action under the configured policy?
02 / Decision
Was the request allowed, held for review, or denied?
03 / Record
What tamper-evident record links the request, decision, and human approval when required?
Illustrative record — field names from the JSON audit export.
| action | policy.violated |
|---|---|
| resourceType · resourceId | policy · ‹policy id› |
| metadata.externalAgentId | support-bot |
| metadata.policyType | tool_invocation |
| metadata.enforcementMode | block |
| metadata.policyDecision.policyVersion | 3 |
| metadata.allowed | false |
| contentHash | ‹SHA-256, computed at write› |
| previousHash | ‹contentHash of the prior record› |
| chainValid | ‹result from /chain/verify› |
Illustrative values, not a live export. Real exports (GET /api/v1/audit-logs/export) carry the computed hashes; check a chain with GET /api/v1/audit-logs/chain/verify.
§ 11 / Deployment
Run Execlave in our cloud. Or run it in yours.
Same product. Your choice of deployment.
11.1 / Managed
Cloud Managed for you.
- ▸Free tier available
- ▸Evidence exports for your SOC 2 Type II audit
- ▸Multi-region deployment on request
- ▸Managed Postgres + Redis
Start free→
11.2 / Self-hosted
Your infra Your data, your control.
- ▸Docker Compose or Kubernetes
- ▸Air-gap compatible
- ▸Agent and trace data stay in your network
- ▸Same product, your SLA
Explore self-hosted→
§ 12 / Compliance & security
Enterprise AI security and compliance — not an afterthought.
12.1
Row-level data isolation
PostgreSQL RLS ensures your data never touches another organization.
12.2
PII detection and scrubbing
Emails, SSNs, credit cards, and API keys detected and redacted before storage — on by default.
12.3
Immutable audit trails
Cryptographically verified, append-only logs. Tamper-evident by design.
12.4
Role-based access control
Principle of least privilege. Owner, Admin, Developer, and Viewer roles across the platform.
Evidence mapped to
SOC 2 Type IIHIPAAGDPRISO 27001EU AI ActPCI DSSNIST AI RMFOWASP ASIFramework mappings help organize governance evidence. They do not certify your organization or guarantee compliance.
§ 13 / FAQ
Questions about AI agent governance.
Understand the enforcement boundary, deployment choices, and evidence before you integrate.
Q. 01How fast is the enforcement layer?
Enforcement is a synchronous decision before the action runs, and every enforce response reports its own server-side cost in a Server-Timing header. Measured in production on 29 October 2026, the server-side decision took 19.9 ms at the median and 27.0 ms at p99, including API-key authentication. Model-backed semantic checks, when enabled, add model latency, and your client adds network time. Method, lab and production figures on /benchmarks.
Q. 02Can I run Execlave on my own infrastructure?
Yes. Self-hosted deployment is available from the Starter plan upward; the Free plan is non-commercial cloud evaluation only. You get the same Docker images we run in our cloud, plus a JWT license key. Agent and trace data stay on your infrastructure; the license check sends usage metrics only, and air-gapped mode sends nothing. See the self-hosted page for details.
Q. 03Which compliance frameworks does Execlave cover?
SOC 2 Type II, ISO 27001, EU AI Act, GDPR, HIPAA, PCI DSS, NIST AI RMF and OWASP ASI. Compliance reports are generated from your actual audit log — not from a questionnaire — and map to the specific controls each framework requires (CC6.1, A.9.1, Art. 14, Art. 30, §164.308, etc.).
Q. 04How is this different from Guardrails / Lakera / Promptfoo?
Those tools focus on input/output validation at the prompt layer. Execlave is the governance layer one level deeper: it sits between the agent and the systems it can act on (tools, APIs, databases, files). Prompt validation catches some attacks; tool-level enforcement blocks unauthorized actions routed through the gate regardless of which prompt produced them, and produces the audit trail your compliance team needs. They are complementary, not competing.
Q. 05Is Execlave an AI Agent Management Platform (AMP)?
Yes. Beyond runtime enforcement, Execlave provides the full agent-management control plane: tiered autonomy governance, a cost circuit breaker, an agent registry with lifecycle and versioning, permission-drift detection, eval-to-policy suggestions, and data-access lineage. All are on by default in both the managed cloud and self-hosted deployments.
§ 14 / START
Talk through your deployment →Your agents are already running. Start governing them. — Execlave: AI Agent Governance and Enforcement Platform
Free tier. No credit card. Instrument an agent in minutes.
No credit card required