Bypass safety interlock
Blocked in prod
Red
plc.command
Manufacturing / OT / ICS
plc.command opens a valve with the safety interlock disabled. Sabotage shape — never callable from an agent.
Fire a curated scenario
Each tile is a domain — click in to see the agent tool calls that operators get to gate. Green-tier reads are authorized outright; Yellow-tier cards park for review; Red-tier cards are production-block cases that use an explicit review walkthrough in this safe demo.
What to try
- Open Finance, fire Look up customer record — Green tier, authorized straight through with no review.
- Open Finance, fire High-value refund, then preview its human-review handoff.
- Open Finance, fire Lift fraud freeze — Red tier in production, routed through review here for the walk-through.
See how Clavenar gates agent actions
Clavenar sits between an AI agent and its tools to allow, hold, or block actions before execution. These cards preview curated catalog dispositions; a live session creates safely scoped demo records.
Red cards describe the expected production block. The live walkthrough routes them through review so you can inspect the decision evidence without executing a destructive action.
Run the 90-second guided preview, then start a scoped live session.
The preview uses labeled sample evidence. A 2-hour live session lets you create your own scoped approvals and ledger rows.
- 1. Allow Preview a read-only fast path.
- 2. Review See the HIL handoff.
- 3. Block Inspect the hard-deny reason.
- 4. Verify Confirm the chain row.
Request-to-ledger flow
Preview why a tool call is allowed, parked for HIL, or marked for a production block. Sample evidence is labeled below; a live session records your own scoped correlation IDs.
checking chain...
-
Agent
Tool call
-
Brain
Intent check
-
Policy
Gate
-
HIL
Review
-
Ledger
Chain row
Authorized fast path
crm.lookup
Representative read-only requests pass without human review and land an authorized ledger row.
Reason: read-only CRM lookup with no export target.
Policy match
green_read_allow: method is read-only and scoped to one customer.
Expected evidence
expected: authorized · demo-sample-allow · chain-verifiable
Open timeline preview → See review events → Open in-browser verifier →Auto-allow
7Human review
54Block
52Manufacturing / OT / ICS
PLC writes, interlock bypass, off-window setpoints.
Total
7
Green
0
Yellow
3
Red
4
7 shown
Off-window safety device write
Needs review
Yellow
plc.command
Manufacturing / OT / ICS
Reactor-coolant setpoint change outside the planned-maintenance window. Control-room operator confirms.
Control-rod setpoint change
Needs review
Yellow
plc.command
Manufacturing / OT / ICS
plc.command targets a safety-critical reactor control rod with interlock on. Control-room operator confirms.
Recipe change on active batch
Needs review
Yellow
plc.command
Manufacturing / OT / ICS
plc.command alters the recipe parameters on an in-progress batch. Confirm the change is sanctioned by the batch-record.
Override QA gate
Blocked in prod
Red
plc.command
Manufacturing / OT / ICS
Agent calls plc.command with the QA-pass flag forced on. Bypassing the QA hold is sabotage-adjacent — hard-deny.
Push uncertified firmware
Blocked in prod
Red
plc.firmware_push
Manufacturing / OT / ICS
plc.firmware_push deploys an unsigned firmware image to PLCs on the production line. Hard-deny — firmware is the lowest layer of trust.
Disable interconnection relay
Blocked in prod
Red
relay.disable
Manufacturing / OT / ICS
relay.disable turns off an interconnection-protection relay without an engineering signoff id. IEC-61850 control — relay disable risks cascading blackout.
No scenarios match this view.
Blast-Radius Autopilot — measured least privilege operator
Blast-Radius Autopilot — measured least privilege
operatorEvery agent is granted a tool-scope envelope. Clavenar reads the tamper-evident ledger to flag the scopes an agent never used, then lets an operator narrow that blast radius in one click — the change is chain-anchored and auditor-verifiable. A fleet gauge tracks the share of granted scope sitting unused.
Operators: open Registered agents
for the fleet gauge, or any agent's
detail page
with ?walkthrough=1 for the guided tour.
Sanitize verdict — per-entity egress actions policy
Sanitize verdict — per-entity egress actions
policy
When an upstream tool reply carries sensitive data, the Egress
Inspector asks the policy engine what to do with each entity
type it located — deny,
sanitize,
pend, or
allow — from a Rego data document
(clavenar.egress.entity_actions).
The same response is blocked or redacted depending on that one map.
Upstream response
{"customer":"Ada Lovelace","ssn":"512-44-1729","status":"active"}
Forwarded — redacted
ssn = sanitize
{"customer":"Ada Lovelace","ssn":"[REDACTED:SSN]","status":"active"}
The SSN span is redacted in place and the rest of the response reaches the agent. An egress_sanitized row lands in the ledger.
Blocked
ssn = deny
403 — upstream response withheld from the agent
Flip the SSN action to deny and the whole response is withheld; an egress_violation row records the block. Credentials deny by default.
Default action map
AWS_ACCESS_KEY→deny
PRIVATE_KEY→deny
API_KEY→deny
DB_CONNECTION→deny
SSN→sanitize
CREDIT_CARD→sanitize
EMAIL→sanitize
Sample shown for illustration — operators tune the map per deployment;
an unmapped type falls back to deny.