High-dollar refund
Needs review
Yellow
commerce.refund
E-commerce / Retail ops
$4,200 refund on a 6-month-old order. In the review band — operator confirms the customer and order.
Fire a curated scenario
Each tile is a domain — click in to see the agent tool calls that operators get to gate. Green-tier reads are authorized outright; Yellow-tier cards park for review; Red-tier cards are production-block cases that use an explicit review walkthrough in this safe demo.
What to try
- Open Finance, fire Look up customer record — Green tier, authorized straight through with no review.
- Open Finance, fire High-value refund, then preview its human-review handoff.
- Open Finance, fire Lift fraud freeze — Red tier in production, routed through review here for the walk-through.
See how Clavenar gates agent actions
Clavenar sits between an AI agent and its tools to allow, hold, or block actions before execution. These cards preview curated catalog dispositions; a live session creates safely scoped demo records.
Red cards describe the expected production block. The live walkthrough routes them through review so you can inspect the decision evidence without executing a destructive action.
Run the 90-second guided preview, then start a scoped live session.
The preview uses labeled sample evidence. A 2-hour live session lets you create your own scoped approvals and ledger rows.
- 1. Allow Preview a read-only fast path.
- 2. Review See the HIL handoff.
- 3. Block Inspect the hard-deny reason.
- 4. Verify Confirm the chain row.
Request-to-ledger flow
Preview why a tool call is allowed, parked for HIL, or marked for a production block. Sample evidence is labeled below; a live session records your own scoped correlation IDs.
checking chain...
-
Agent
Tool call
-
Brain
Intent check
-
Policy
Gate
-
HIL
Review
-
Ledger
Chain row
Authorized fast path
crm.lookup
Representative read-only requests pass without human review and land an authorized ledger row.
Reason: read-only CRM lookup with no export target.
Policy match
green_read_allow: method is read-only and scoped to one customer.
Expected evidence
expected: authorized · demo-sample-allow · chain-verifiable
Open timeline preview → See review events → Open in-browser verifier →Auto-allow
7Human review
54Block
52E-commerce / Retail ops
High-dollar refunds, price-list exfil, stale-order fraud.
Total
6
Green
0
Yellow
3
Red
3
6 shown
Export price list externally
Blocked in prod
Red
commerce.bulk_export
E-commerce / Retail ops
18k-row price-table push to a competitor-shaped endpoint. Hard-deny — competitively sensitive.
Stale-order refund
Blocked in prod
Red
commerce.refund
E-commerce / Retail ops
$120 refund on a 412-day-old order. Stale-order refunds are the fraud-laundering shape — hard-deny regardless of amount.
Bulk-issue gift cards
Needs review
Yellow
commerce.gift_card_issue
E-commerce / Retail ops
commerce.gift_card_issue mints 600 cards at $50 each. Bulk gift cards are the laundering vector — confirm the promotional campaign.
Redirect seller payout
Blocked in prod
Red
marketplace.update_payout
E-commerce / Retail ops
marketplace.update_payout swaps the bank account on a top seller's payout schedule. Vendor-redirect fraud shape — hard-deny.
Adjust inventory to negative
Needs review
Yellow
commerce.inventory_adjust
E-commerce / Retail ops
commerce.inventory_adjust sets the on-hand count of a SKU to -1200. Negative inventory is the shrinkage-cover-up shape.
No scenarios match this view.
Blast-Radius Autopilot — measured least privilege operator
Blast-Radius Autopilot — measured least privilege
operatorEvery agent is granted a tool-scope envelope. Clavenar reads the tamper-evident ledger to flag the scopes an agent never used, then lets an operator narrow that blast radius in one click — the change is chain-anchored and auditor-verifiable. A fleet gauge tracks the share of granted scope sitting unused.
Operators: open Registered agents
for the fleet gauge, or any agent's
detail page
with ?walkthrough=1 for the guided tour.
Sanitize verdict — per-entity egress actions policy
Sanitize verdict — per-entity egress actions
policy
When an upstream tool reply carries sensitive data, the Egress
Inspector asks the policy engine what to do with each entity
type it located — deny,
sanitize,
pend, or
allow — from a Rego data document
(clavenar.egress.entity_actions).
The same response is blocked or redacted depending on that one map.
Upstream response
{"customer":"Ada Lovelace","ssn":"512-44-1729","status":"active"}
Forwarded — redacted
ssn = sanitize
{"customer":"Ada Lovelace","ssn":"[REDACTED:SSN]","status":"active"}
The SSN span is redacted in place and the rest of the response reaches the agent. An egress_sanitized row lands in the ledger.
Blocked
ssn = deny
403 — upstream response withheld from the agent
Flip the SSN action to deny and the whole response is withheld; an egress_violation row records the block. Credentials deny by default.
Default action map
AWS_ACCESS_KEY→deny
PRIVATE_KEY→deny
API_KEY→deny
DB_CONNECTION→deny
SSN→sanitize
CREDIT_CARD→sanitize
EMAIL→sanitize
Sample shown for illustration — operators tune the map per deployment;
an unmapped type falls back to deny.