AI agents are issuing refunds, changing production infrastructure and reading customer data — right now, with real credentials.
Aigentical does. It decides whether each agent action may run — allow, hold for a human, or deny — before it reaches your systems, and keeps evidence you own. Runs in your VPC or on-prem, and keeps running with no internet access once installed.
In April 2026 an AI agent at PocketOS found a locally stored Railway API token and used it to delete a production volume; reports say the backups went too. The token was valid, so the API said yes. Guardrails check what goes into the model. IAM checks who holds the key. Neither asks the question that mattered:
May this agent take this action, on this resource, right now?
Sources: Railway, Apr 29–30, 2026; PointGuard AI incident summary. Railway later recovered the customer data. Not an Aigentical customer.
Reads what goes into and out of the model. Never sees the action.
Decides the action itself, before it runs. Complements the guardrails you already have.
Aigentical decides before an action runs, on every route it governs, alongside the tools you already have.
Every tool call, hand-off, refund or delete is allowed, refused, or held for a human approval the agent can't forge. On brokered routes (calls Aigentical places for the agent) the agent never holds the production keys.
Each allow, hold and refusal is tied to the agent and how strongly it proved who it is. Change an entry and verification shows it. You can turn off blocking. Never the record.
Start in monitor mode. Every agent appears, including ones nobody registered, with what enforcement would have refused. When you're ready, one step switches to enforce.
How it works — the architecture, the decision point and every control →
Identity, prompt safety, your policy, blast radius (how much one call can touch), then data and DLP (data-loss prevention). Watch one call move through them.
Enforcement isn't one proxy. It sits at four points: the LLM proxy, MCP intercept, the Actions API & SDK, and the RAG firewall.
On brokered routes the agent never holds the production credential. Aigentical does, and uses it only for an allowed call.
High-risk actions fail closed. Without a single-use approval, they don't run.
Coverage depends on restricting direct credentials and alternate routes, which we set up with you.
An unapproved tool call refused, a destructive action held for a human approval the agent can't forge, and the record of both.
The PocketOS delete, replayed against Aigentical.
Mappings are Aigentical's own: evidence for your program, not a certification. Aigentical is not itself certified or audited against these frameworks, and the mappings imply no review or endorsement by their owners. See every framework and control we map →
No agent rewrites and no new framework. You change where your agents send their calls, watch, then decide.
A container and a Postgres database inside your environment, next to your agents. The decision record stays under your control. Once installed it runs with no internet access; AI-assisted prompt detection then uses a model you host.
Change one base URL for LLM traffic, point MCP clients at the gateway, or add one line to Python code. The console writes the exact snippet for Copilot Studio, LangChain, CrewAI and more.
Nothing is blocked yet. You see what enforcement would refuse before you switch it on.
Approve the tools each agent actually uses, mark what needs a human, and switch to enforce in one step.
I built Aigentical after watching teams wire AI agents into production with real credentials and no way to say no at the moment an action fires. Every “governance” answer I found reviewed things after the fact, or trusted the agent to behave. So we built the part that decides in-line — and keeps a record you can hand to an auditor. If you're putting agents anywhere near systems that matter, I'd genuinely like to hear what you're up against.
— SANGEET RAJAN · FOUNDER & CEO · 20 YEARS BIG FOUR GRC AND CYBERSECURITY
We deploy it with you on staging first, and hand you the evidence, not a login and a wiki.
10 inventions with patent applications pending.