Financial services
Agent actions on customer data and payments need approval and proof.
AI agent governance · sovereign by design
Decide.allowblockhold Undo.halt sessioncontainmentrollback · next Prove.tamper-evidentsignedverifiable
Every agent action. Inside your boundary.
Polareyes sits in the request path between your AI agents and the tools, data and systems they act on. Every call is allowed, blocked or held for a human, and every decision leaves signed evidence that never leaves your environment.
Gate live · enforcingSIMULATION
tenancy: demo-sg · policy v14
Allowed0
Blocked0
Held0
You decided0
Kill switch engaged · sessions halted
Writes since the last checkpoint are flagged for review. Automatic rollback is on the roadmap.
receipts 0 signed · head —
You are the reviewer. Approve or deny held calls before the clock runs out. This is a simulation running entirely in your browser; no request leaves this page.
How it works · the request path
Your environment
CallersAI agentscoding · SaaS · custom
Control pointPolareyespolicy · identity · approval · evidenceinspects request and response
- allow
- block
- hold for a human
TargetsTools and systemsMCP · APIs · files · data
Every decision → signed evidence in your key vaultGrants down to tool, resource and argument
Reversibility classes
If the agent gets it wrong, can you undo it?
Polareyes grades every tool call from R0 to R4 before it runs, using the open Reversibility Classes spec. The class, not the model's confidence, sets how much an agent may do alone.
R0No effect
Nothing changes outside the agent's working context.
actRead a file, run a SELECT, searchR1Restorable
Fully restorable with ordinary effort, and nobody outside saw it.
act, then notifyEdit a file under version controlR2Compensable
Can't be restored, but a known fix exists at bounded cost.
approve, or act in budgetCharge a card, then refund itR3Hard to recover
Needs a human or out-of-band recovery, or changes access, credentials or availability.
approve each timeRotate a secret, force-pushR4Irreversible
A disclosure, unrecoverable destruction, or a consequence that can't be recalled.
never autonomousSend a message, transfer funds with no recall
Try an action
R2 · Compensable. Expensive, but a refund restores the position. Polareyes asks for approval, or lets it run inside a pre-approved budget.
Severity scores get these backwards; reversibility doesn't. The classes are an open specification with a public registry of classified MCP tools: github.com/waghmaredb/reversibility-classes
Sovereignty
The decision happens somewhere. Where?
Most AI security platforms decide in the vendor's cloud, even when data is kept in-region. Polareyes puts the control point at the pole of your own estate.
For banks, government and critical infrastructure, the record of who allowed an agent to act should be held by the customer, not the vendor. Polareyes is built so that it is.
Proof
Evidence your auditor checks without asking us.
Every decision in the gate above is being chained into this ledger right now. Change one record and see what happens.
Every decision gets a signed receipt that carries the hash of the one before it. Change one decision after the fact and every later receipt stops matching. A reviewer can also keep a checkpoint of the ledger head in their own browser, so a later rewrite shows up even if the whole ledger is replaced.
Demo: hashed in your browser. Production: signed with keys from your own key vault.
Waiting for decisions from the gate.
| # | Time | Agent · action | Decision | By | Hash ← prev |
|---|---|---|---|---|---|
| No records yet. | |||||
Regulation
The rules agents now answer to.
Regulators in Asia Pacific and Europe now expect inventories, human oversight, the power to stop, and records you can show. Here is where Polareyes helps you evidence each one.
EU AI Act
High-risk obligations apply from 2 December 2027, moved from August 2026 by Regulation (EU) 2026/1744.Art. 12 · record-keepingAutomatic logs of events over the system's lifetime.
→tamper-evident record of every callsigned in your tenancy
Art. 14 · human oversightPeople can override or reverse an output, and stop the system in a safe state.
→hold for approvalhalt sessionfile rollback · roadmap
MAS Guidelines on AI Risk Management
Issued 7 October 2026 for Singapore financial institutions; in effect from 7 October 2027.Inventory and materialityKeep AI inventories and assess the risk of each use.
→agent registry with ownersR0–R4 class on every action
Life-cycle controlsHuman oversight, monitoring and change management.
→approval workflowsVisual Commandsimulated, staged policy rollout
Third-party AIStay accountable, and limit or suspend a service when its risk exceeds appetite.
→control point in your tenancyper-agent kill switch
Model AI Governance Framework for Agentic AI
Launched by Singapore's IMDA on 22 January 2026 for organisations deploying agents.Bound risks by designLimit an agent's tools, permissions and scope of action.
→grants to tool, resource and argument
Human accountabilityCheckpoints that can override, intercept or review agent actions.
→hold for a qualified reviewer
Deploy and monitorProgressive roll-outs and real-time monitoring.
→canary rolloutdrift and injection detection
APRA CPS 230 Operational Risk Management
In force for Australian regulated entities since 1 July 2025.ControlsControls that are tested and work when needed.
→fail-closed preflightpolicy simulation
ContinuityKeep critical operations running through severe disruption.
→rehearsed backup, restore and network resilience
Service providersManage the risk from material service providers.
→decision, keys and evidence under your control
RBI FREE-AI framework
Recommendations of the Reserve Bank of India's committee, reported August 2025.People firstHuman oversight for medium- and high-risk AI tasks.
→higher-class actions held for approval
Risk classificationClassify AI use as low, medium or high risk.
→every action graded R0–R4
AuditabilityPart of each entity's board-approved AI policy.
→signed evidence packages
Plain-language summaries of public texts as of October 2026. Polareyes helps you produce evidence; it does not make a system compliant on its own. Not legal advice.
Security frameworks
Map your agent estate to the frameworks your CISO reports on.
Polareyes maps every registered agent, grant and decision to OWASP, MITRE ATLAS, NIST and ISO/IEC 42001, then shows where you are covered, partly covered or exposed. Pick a framework for the estate summary, a column for a control, or an agent's name for its own profile and gaps.
Example estate · illustrative
✓covered~partly covered✗gap in this estate–outside Polareyes' scope
OWASP Top 10 for Agentic Applications (2026) and for LLM Applications (2025); MITRE ATLAS v5.6.0 agent techniques; NIST AI RMF 1.0 with the Generative AI Profile (AI 600-1); ISO/IEC 42001:2023, indicative. A technical mapping, not certification. Coverage reflects Polareyes' control point; model-layer and training-data risks need controls of their own.
Platform
One control plane for every agent action.
From the first registered agent to the auditor's evidence pack: governance, enforcement, response and proof in one console, deployed in your environment.
- Observe, then enforce
- Run a policy in observe mode to see what it would block, then switch to enforce: allow, block or hold every request and response.
- Fine-grained access
- Agent, tool, resource and argument grants with expiry, revocation and entitlement reviews.
- Tool and resource catalogues
- The approved MCP tools, servers and filesystem resources, each with a named owner. Approval of a new tool at first contact is on the roadmap.
- Usage controls
- Byte, token and cost budgets with billing reconciliation, plus bounded streaming and multimodal inference.
- Approval workflows
- Qualified reviewers, independent decisions, deadlines and escalation.
- Separation of duties
- Approvals are signed and kept apart from policy authoring. Access changes are independently reviewed.
- Absence coverage
- Approvals keep moving when reviewers are away.
- Notifications
- Durable delivery queues with retries and delivery status.
- Emergency response
- Halt any live session in one click from the Sessions view and contain an agent. Journal-backed file rollback is next on the roadmap.
- Incident management
- Create, assign, investigate, track, close and reopen cases.
- Response automation
- Independently reviewed playbooks with bounded execution, retries, cancellation and remediation checks.
- Azure response adapters
- VM remediation and credential rotation, run in isolated script workers.
- Signed receipts
- A signed receipt for every decision, hash-chained to a verified head, searchable by outcome and severity and exportable as evidence.
- Evidence custody and privacy
- Retention, preservation holds, copy tracking, reviewed deletion and erasure cases.
- Governance reporting
- Ownership reviews and executive, operational and audit reports, exported or delivered on schedule.
- SIEM export and webhooks
- Receipts and security events delivered to your SIEM or webhooks, with delivery-loss and pending-delivery tracking, readback and retention checks.
- Framework mapping
- Map every agent, grant and decision to OWASP, MITRE ATLAS, NIST and ISO/IEC 42001, with coverage, gaps and the rules behind each control.
- Policy management
- Create, edit, clone, import, version and archive signed policies.
- Policy testing
- A built-in attack corpus plus your own test cases, run in a disposable sandbox. The impact preview shows only what would change.
- Controlled rollout
- Draft, simulate, review, roll out. Nothing activates until an independent reviewer approves it, and every rollout can roll back.
- Enterprise identity
- Microsoft Entra ID owns users, teams, invitations and deactivation. Polareyes verifies those identities and enforces role-based access on the server.
- Service identities
- Machine identities bound to scoped roles: register, scope, review, revoke. Credentials stay in Entra or your broker, never in Polareyes.
- Users, teams and roles
- Team-scoped access and custom permissions, every action attributed to an operator, and recovery administrator groups that prevent accidental lockout.
- Credential controls
- OAuth on-behalf-of exchange, scoped delegation and provider-key rotation.
- Threat detection
- Injection rules for delimiter breakouts, encoded payloads, indirect injection, spoofed instruction hierarchies, hidden characters, tool coercion and persona hijacks, plus behavioural baselines and tool-definition changes.
- Agent registration
- Each agent declares its operating boundary: business purpose, accountable owner, environment, framework and data class. Any trust change goes through independent policy review.
- Live sessions
- Every session shown as live, stale, halted or ended, with observed and refused traffic, refreshed every few seconds.
- Enforcement radar
- Each agent placed by identity, policy, freshness and live runtime signals: verified boundary, governed with gaps, or unverified.
- Role-aware console
- Persona-based navigation, search, dashboards and permission-controlled actions.
- Fleet operations
- Regional gateways that keep decisions in-region, cluster health, live enforcement traces, and Docker or systemd workers.
- Ecosystem map
- Every agent with its owners, tools, resources, live sessions and pending human reviews.
Built for
Where an agent's action has to answer to someone.
Polareyes is for organisations that cannot hand the decision, or the record of it, to a third party.
Government and public sector
Decisions and evidence must stay in-country and in-tenancy.
Critical infrastructure and OT
A human signs before an agent changes a live system.
Regulated APAC enterprises
Separation of duties from cloud, EDR and firewall vendors.
Keep the security stack you have. Posture and cloud detection tools show you what an agent can reach. Add Polareyes where agents write data, move money or touch regulated systems, and decide whether each action happens.
Technical specifications
Deployed where your data already lives.
Built cloud-native: Azure is the reference deployment, AWS is tested, and Kubernetes support is planned so Polareyes runs wherever your clusters run. The control plane, keys and evidence always stay under your accounts.
Polareyes
control plane
runs in your tenancycontrol plane
Deployment
Your own tenancy, cloud-native: Azure reference deployment, tested on AWS, Kubernetes planned. Docker or systemd workers with Linux host-network enforcement.
Protocols
Model Context Protocol, local and remote. Model-provider APIs.
Identity
Microsoft Entra ID (OIDC) for users, teams and machine identities. OAuth on-behalf-of.
Keys and signing
Customer-held keys in Azure Key Vault.
Evidence store
Customer-held storage with evidence anchoring in Azure Blob.
Integrations
SIEM export and security-event webhooks. SaaS, database and model-provider connectors.
Engineered to fail closed
Fail-closed preflight
A deployment passes preflight and final acceptance checks before go-live, and fails closed when it can't.
Rehearsed recovery
Backup and restore, plus restart and network-resilience rehearsals.
Evidence continuity
Immutable evidence verification, continuity checks and metadata-controlled capture.
Signed with your keys
Policies, approvals and evidence packages are signed with keys held in your own Key Vault.
Capabilities as of October 2026. Key Vault and Blob reflect the Azure reference deployment.
Early access
Govern your agents from inside your own boundary.
We are opening Polareyes to a small number of regulated teams first. Tell us where your agents act, and we will set up a scoping call and a sovereign pilot in your own tenancy.
join the listscoping callpilot in your tenancyevidence review
Request early access →
hello@polareyes.ai