Step 1 of 5
Each tile is a domain — click in to see the agent tool calls that operators get to gate. Green-tier reads are authorized outright; Yellow-tier cards park for review; Red-tier cards are production-block cases that use an explicit review walkthrough in this safe demo.
Clavenar sits between an AI agent and its tools to allow, hold, or block actions before execution. These cards preview curated catalog dispositions; a live session creates safely scoped demo records.
Red cards describe the expected production block. The live walkthrough routes them through review so you can inspect the decision evidence without executing a destructive action.
Run the 90-second guided preview, then start a scoped live session.
The preview uses labeled sample evidence. A 2-hour live session lets you create your own scoped approvals and ledger rows.
Preview why a tool call is allowed, parked for HIL, or marked for a production block. Sample evidence is labeled below; a live session records your own scoped correlation IDs.
Agent
Tool call
Brain
Intent check
Policy
Gate
HIL
Review
Ledger
Chain row
crm.lookup
Representative read-only requests pass without human review and land an authorized ledger row.
Reason: read-only CRM lookup with no export target.
Policy match
green_read_allow: method is read-only and scoped to one customer.
Expected evidence
expected: authorized · demo-sample-allow · chain-verifiable
Open timeline preview → See review events → Open in-browser verifier →Auto-allow
7Human review
54Block
52Run one allow, one review, and one production-block path before scanning the full catalog.
Green
crm.lookup
Finance / CRM / User management
Agent calls crm.lookup to read a customer's profile. Read-only, no PII export — Brain raises nothing and policy allows it outright. No human in the loop.
Yellow
stripe.refund
Finance / CRM / User management
Agent requests stripe.refund for $8,420. The demo catalog marks this high-value refund for human review.
Red
accounts.lift_freeze
Finance / CRM / User management
Agent calls accounts.lift_freeze on an account flagged for chargeback fraud. Bypassing fraud holds via agent is hard-deny.
113 scenarios across 21 domains.
21 shown
High-value moves, account changes, hard-destruction calls.
PHI exports, external shares, email-borne leakage.
Privileged docs, bulk discovery, litigation-hold exports.
Supply-chain, repo scope, malicious-code emissions.
Comp exports, candidate PII, recruiter forwarding.
Prod applies, IAM grants, off-window secret rotations.
PLC writes, interlock bypass, off-window setpoints.
Unsigned model deploys, dataset exfil, staging promotions.
High-dollar refunds, price-list exfil, stale-order fraud.
SECRET access, CUI leaks, unattested classified reads.
Bulk transcripts, grade emails, consent-gated disclosures.
Fast-track approvals, PHI-tagged history, anonymous claims.
Account-takeover, reset storms, 2FA-reset workflows.
Outbound blasts, brand impersonation, list-quality leaks.
Routing changes, customs edits, vendor onboarding.
SIM swap, port-out, CDR exfil — carrier-side controls.
Model swaps, eval bypass, runaway loops, training-data egress.
21 CFR Part 11, GxP audit trails, clinical-trial integrity.
Voter rolls, FOIL, permits, emergency alerts.
DLP bypass, backup encryption, CA-root adds — the controls that protect the controls.
Identity-modifying tools, MFA disable, personal-email exfil — patterns that ignore vertical boundaries.
No categories match this view.
Every agent is granted a tool-scope envelope. Clavenar reads the tamper-evident ledger to flag the scopes an agent never used, then lets an operator narrow that blast radius in one click — the change is chain-anchored and auditor-verifiable. A fleet gauge tracks the share of granted scope sitting unused.
Operators: open Registered agents
for the fleet gauge, or any agent's
detail page
with ?walkthrough=1 for the guided tour.
When an upstream tool reply carries sensitive data, the Egress
Inspector asks the policy engine what to do with each entity
type it located — deny,
sanitize,
pend, or
allow — from a Rego data document
(clavenar.egress.entity_actions).
The same response is blocked or redacted depending on that one map.
Upstream response
{"customer":"Ada Lovelace","ssn":"512-44-1729","status":"active"}
ssn = sanitize
{"customer":"Ada Lovelace","ssn":"[REDACTED:SSN]","status":"active"}
The SSN span is redacted in place and the rest of the response reaches the agent. An egress_sanitized row lands in the ledger.
ssn = deny
403 — upstream response withheld from the agent
Flip the SSN action to deny and the whole response is withheld; an egress_violation row records the block. Credentials deny by default.
Default action map
AWS_ACCESS_KEY→deny
PRIVATE_KEY→deny
API_KEY→deny
DB_CONNECTION→deny
SSN→sanitize
CREDIT_CARD→sanitize
EMAIL→sanitize
Sample shown for illustration — operators tune the map per deployment;
an unmapped type falls back to deny.