Forward privileged memo
Blocked in prod
Red
docs.forward_external
Legal / e-discovery
Paralegal agent attempts docs.forward_external on an attorney-client memo. Privileged communications never leave via agent.
Fire a curated scenario
Each tile is a domain — click in to see the agent tool calls that operators get to gate. Green-tier reads are authorized outright; Yellow-tier cards park for review; Red-tier cards are production-block cases that use an explicit review walkthrough in this safe demo.
What to try
- Open Finance, fire Look up customer record — Green tier, authorized straight through with no review.
- Open Finance, fire High-value refund, then preview its human-review handoff.
- Open Finance, fire Lift fraud freeze — Red tier in production, routed through review here for the walk-through.
See how Clavenar gates agent actions
Clavenar sits between an AI agent and its tools to allow, hold, or block actions before execution. These cards preview curated catalog dispositions; a live session creates safely scoped demo records.
Red cards describe the expected production block. The live walkthrough routes them through review so you can inspect the decision evidence without executing a destructive action.
Run the 90-second guided preview, then start a scoped live session.
The preview uses labeled sample evidence. A 2-hour live session lets you create your own scoped approvals and ledger rows.
- 1. Allow Preview a read-only fast path.
- 2. Review See the HIL handoff.
- 3. Block Inspect the hard-deny reason.
- 4. Verify Confirm the chain row.
Request-to-ledger flow
Preview why a tool call is allowed, parked for HIL, or marked for a production block. Sample evidence is labeled below; a live session records your own scoped correlation IDs.
checking chain...
-
Agent
Tool call
-
Brain
Intent check
-
Policy
Gate
-
HIL
Review
-
Ledger
Chain row
Authorized fast path
crm.lookup
Representative read-only requests pass without human review and land an authorized ledger row.
Reason: read-only CRM lookup with no export target.
Policy match
green_read_allow: method is read-only and scoped to one customer.
Expected evidence
expected: authorized · demo-sample-allow · chain-verifiable
Open timeline preview → See review events → Open in-browser verifier →Auto-allow
7Human review
54Block
52Legal / e-discovery
Privileged docs, bulk discovery, litigation-hold exports.
Total
6
Green
0
Yellow
4
Red
2
6 shown
Bulk case-file download
Needs review
Yellow
docs.bulk_export
Legal / e-discovery
5,000-file discovery dump against a case under active litigation hold. Operator confirms vendor scope.
Export case under hold
Needs review
Yellow
docs.bulk_export
Legal / e-discovery
docs.bulk_export on a matter that's in the active litigation-hold list. Operator confirms scope before approval.
Send redlined contract externally
Needs review
Yellow
docs.forward_external
Legal / e-discovery
docs.forward_external ships a redlined master services agreement to opposing counsel. Operator confirms the redlines match the approved offer.
Release litigation hold
Blocked in prod
Red
holds.release
Legal / e-discovery
Agent calls holds.release on a matter that's still in active discovery. Hard-deny — hold release is a courts-only workflow.
Auto-respond to subpoena
Needs review
Yellow
docs.subpoena_respond
Legal / e-discovery
docs.subpoena_respond generates a bulk response packet to a subpoena. Operator confirms scope and privilege flagging.
No scenarios match this view.
Blast-Radius Autopilot — measured least privilege operator
Blast-Radius Autopilot — measured least privilege
operatorEvery agent is granted a tool-scope envelope. Clavenar reads the tamper-evident ledger to flag the scopes an agent never used, then lets an operator narrow that blast radius in one click — the change is chain-anchored and auditor-verifiable. A fleet gauge tracks the share of granted scope sitting unused.
Operators: open Registered agents
for the fleet gauge, or any agent's
detail page
with ?walkthrough=1 for the guided tour.
Sanitize verdict — per-entity egress actions policy
Sanitize verdict — per-entity egress actions
policy
When an upstream tool reply carries sensitive data, the Egress
Inspector asks the policy engine what to do with each entity
type it located — deny,
sanitize,
pend, or
allow — from a Rego data document
(clavenar.egress.entity_actions).
The same response is blocked or redacted depending on that one map.
Upstream response
{"customer":"Ada Lovelace","ssn":"512-44-1729","status":"active"}
Forwarded — redacted
ssn = sanitize
{"customer":"Ada Lovelace","ssn":"[REDACTED:SSN]","status":"active"}
The SSN span is redacted in place and the rest of the response reaches the agent. An egress_sanitized row lands in the ledger.
Blocked
ssn = deny
403 — upstream response withheld from the agent
Flip the SSN action to deny and the whole response is withheld; an egress_violation row records the block. Credentials deny by default.
Default action map
AWS_ACCESS_KEY→deny
PRIVATE_KEY→deny
API_KEY→deny
DB_CONNECTION→deny
SSN→sanitize
CREDIT_CARD→sanitize
EMAIL→sanitize
Sample shown for illustration — operators tune the map per deployment;
an unmapped type falls back to deny.