Swap subscriber SIM
Blocked in prod
Red
subscriber.sim_swap
Telecom / Carrier ops
subscriber.sim_swap binds a subscriber's MSISDN to a new IMSI. Canonical account-takeover vector — never agent-callable.
Fire a curated scenario
Each tile is a domain — click in to see the agent tool calls that operators get to gate. Green-tier reads are authorized outright; Yellow-tier cards park for review; Red-tier cards are production-block cases that use an explicit review walkthrough in this safe demo.
What to try
- Open Finance, fire Look up customer record — Green tier, authorized straight through with no review.
- Open Finance, fire High-value refund, then preview its human-review handoff.
- Open Finance, fire Lift fraud freeze — Red tier in production, routed through review here for the walk-through.
See how Clavenar gates agent actions
Clavenar sits between an AI agent and its tools to allow, hold, or block actions before execution. These cards preview curated catalog dispositions; a live session creates safely scoped demo records.
Red cards describe the expected production block. The live walkthrough routes them through review so you can inspect the decision evidence without executing a destructive action.
Run the 90-second guided preview, then start a scoped live session.
The preview uses labeled sample evidence. A 2-hour live session lets you create your own scoped approvals and ledger rows.
- 1. Allow Preview a read-only fast path.
- 2. Review See the HIL handoff.
- 3. Block Inspect the hard-deny reason.
- 4. Verify Confirm the chain row.
Request-to-ledger flow
Preview why a tool call is allowed, parked for HIL, or marked for a production block. Sample evidence is labeled below; a live session records your own scoped correlation IDs.
checking chain...
-
Agent
Tool call
-
Brain
Intent check
-
Policy
Gate
-
HIL
Review
-
Ledger
Chain row
Authorized fast path
crm.lookup
Representative read-only requests pass without human review and land an authorized ledger row.
Reason: read-only CRM lookup with no export target.
Policy match
green_read_allow: method is read-only and scoped to one customer.
Expected evidence
expected: authorized · demo-sample-allow · chain-verifiable
Open timeline preview → See review events → Open in-browser verifier →Auto-allow
7Human review
54Block
52Telecom / Carrier ops
SIM swap, port-out, CDR exfil — carrier-side controls.
Total
6
Green
0
Yellow
2
Red
4
6 shown
Port number to rival carrier
Blocked in prod
Red
subscriber.port_out
Telecom / Carrier ops
subscriber.port_out moves a number to another carrier. ATO + customer-loss vector — hard-deny.
Bulk export Call Detail Records
Needs review
Yellow
network.cdr_export
Telecom / Carrier ops
network.cdr_export ships 50,000 subscriber CDRs to an external bucket. Mass-surveillance shape — confirm warrant or compliance contract.
Reset voicemail password
Needs review
Yellow
subscriber.vm_password_reset
Telecom / Carrier ops
subscriber.vm_password_reset resets a subscriber's voicemail PIN. Known weak link in SIM-swap chains — confirm identity-verification.
Change E911 registered address
Blocked in prod
Red
subscriber.e911_address
Telecom / Carrier ops
subscriber.e911_address updates the registered E911 address on a subscriber line. Life-safety implications if wrong — hard-deny.
Provision lawful intercept
Blocked in prod
Red
network.li_provision
Telecom / Carrier ops
network.li_provision taps a subscriber line. Requires a warrant + carrier-compliance review — never agent-callable.
No scenarios match this view.
Blast-Radius Autopilot — measured least privilege operator
Blast-Radius Autopilot — measured least privilege
operatorEvery agent is granted a tool-scope envelope. Clavenar reads the tamper-evident ledger to flag the scopes an agent never used, then lets an operator narrow that blast radius in one click — the change is chain-anchored and auditor-verifiable. A fleet gauge tracks the share of granted scope sitting unused.
Operators: open Registered agents
for the fleet gauge, or any agent's
detail page
with ?walkthrough=1 for the guided tour.
Sanitize verdict — per-entity egress actions policy
Sanitize verdict — per-entity egress actions
policy
When an upstream tool reply carries sensitive data, the Egress
Inspector asks the policy engine what to do with each entity
type it located — deny,
sanitize,
pend, or
allow — from a Rego data document
(clavenar.egress.entity_actions).
The same response is blocked or redacted depending on that one map.
Upstream response
{"customer":"Ada Lovelace","ssn":"512-44-1729","status":"active"}
Forwarded — redacted
ssn = sanitize
{"customer":"Ada Lovelace","ssn":"[REDACTED:SSN]","status":"active"}
The SSN span is redacted in place and the rest of the response reaches the agent. An egress_sanitized row lands in the ledger.
Blocked
ssn = deny
403 — upstream response withheld from the agent
Flip the SSN action to deny and the whole response is withheld; an egress_violation row records the block. Credentials deny by default.
Default action map
AWS_ACCESS_KEY→deny
PRIVATE_KEY→deny
API_KEY→deny
DB_CONNECTION→deny
SSN→sanitize
CREDIT_CARD→sanitize
EMAIL→sanitize
Sample shown for illustration — operators tune the map per deployment;
an unmapped type falls back to deny.