Skip to content

Chain verification

Walking the SHA-256 chain…

Save current view

Name this filter set to recall it later. Stored in this browser only.

See how Clavenar gates agent actions

Clavenar sits between an AI agent and its tools to allow, hold, or block actions before execution. These cards preview curated catalog dispositions; a live session creates safely scoped demo records.

Red cards describe the expected production block. The live walkthrough routes them through review so you can inspect the decision evidence without executing a destructive action.

Run the 90-second guided preview, then start a scoped live session.

The preview uses labeled sample evidence. A 2-hour live session lets you create your own scoped approvals and ledger rows.

Run guided preview Start live session
  1. 1. Allow Preview a read-only fast path.
  2. 2. Review See the HIL handoff.
  3. 3. Block Inspect the hard-deny reason.
  4. 4. Verify Confirm the chain row.

Request-to-ledger flow

Preview why a tool call is allowed, parked for HIL, or marked for a production block. Sample evidence is labeled below; a live session records your own scoped correlation IDs.

  1. Agent

    Tool call

  2. Brain

    Intent check

  3. Policy

    Gate

  4. HIL

    Review

  5. Ledger

    Chain row

Authorized fast path crm.lookup

Representative read-only requests pass without human review and land an authorized ledger row.

Reason: read-only CRM lookup with no export target.

Policy match

green_read_allow: method is read-only and scoped to one customer.

Expected evidence

expected: authorized · demo-sample-allow · chain-verifiable

Open timeline preview →

Auto-allow

7

Human review

54

Block

52
← All categories / Customer support / fraud

Customer support / fraud

Account-takeover, reset storms, 2FA-reset workflows.

Total

7

Green

1

Yellow

4

Red

2

PII lookup without ticket

Needs review

Yellow support.pii_lookup

Customer support / fraud

support.pii_lookup pulls a customer's full record with no linked support ticket. Free-pull PII access is the abuse-monitoring shape.

Start live session

Unlock account without 2FA verify

Blocked in prod

Red support.account_unlock

Customer support / fraud

support.account_unlock bypasses the 2FA-on-file verification step. Hard-deny — defeats account-recovery enforcement.

Start live session

Refund without proof of purchase

Needs review

Yellow support.refund

Customer support / fraud

support.refund issues a refund with no attached order_id. Free-refund pattern — operator confirms before approval.

Start live session

Read a support ticket

Authorized fast path

Green support.ticket_read

Customer support / fraud

Support agent calls support.ticket_read on a ticket linked to the active session. Scoped read, no account mutation — authorized with no human in the loop.

Start live session

Explore other categories →

Blast-Radius Autopilot — measured least privilege operator

Blast-Radius Autopilot — measured least privilege

operator

Every agent is granted a tool-scope envelope. Clavenar reads the tamper-evident ledger to flag the scopes an agent never used, then lets an operator narrow that blast radius in one click — the change is chain-anchored and auditor-verifiable. A fleet gauge tracks the share of granted scope sitting unused.

Operators: open Registered agents for the fleet gauge, or any agent's detail page with ?walkthrough=1 for the guided tour.

Sanitize verdict — per-entity egress actions policy

Sanitize verdict — per-entity egress actions

policy

When an upstream tool reply carries sensitive data, the Egress Inspector asks the policy engine what to do with each entity type it located — deny, sanitize, pend, or allow — from a Rego data document (clavenar.egress.entity_actions). The same response is blocked or redacted depending on that one map.

Upstream response

{"customer":"Ada Lovelace","ssn":"512-44-1729","status":"active"}
Forwarded — redacted ssn = sanitize 
{"customer":"Ada Lovelace","ssn":"[REDACTED:SSN]","status":"active"}

The SSN span is redacted in place and the rest of the response reaches the agent. An egress_sanitized row lands in the ledger.

Blocked ssn = deny 
403 — upstream response withheld from the agent

Flip the SSN action to deny and the whole response is withheld; an egress_violation row records the block. Credentials deny by default.

Default action map

AWS_ACCESS_KEY→deny PRIVATE_KEY→deny API_KEY→deny DB_CONNECTION→deny SSN→sanitize CREDIT_CARD→sanitize EMAIL→sanitize

Sample shown for illustration — operators tune the map per deployment; an unmapped type falls back to deny.