One real session, replayed from its capture: the model works the ticket, three Class 2 proposals fail with MCP error -32042 carrying the approval URL, a named human approves exactly one out of band, and the chain verifies with the approval row on it. Driver committed at demo/record_session.py.
interactive · click and scroll itlive
All nineteen scenarios, both arms, every row expandable into its full tool-call trace. Generated from the committed run, so the page cannot drift from the data.
Agent guardrails are usually a paragraph in a prompt, which is a request. Here the boundary is deterministic code outside the model, the model cannot lower a classification, an action nobody has ruled on fails closed to needing a human, and every decision is recorded before it executes rather than after.
Who it serves
Anyone putting an agent in front of systems where a wrong action is expensive to undo.
Who it is for
Teams who need to explain to an auditor why an automated system did something.
How it works
The agent proposesIt cannot reach n8n or anything else directly. It asks for one action against one named system.
Deterministic classificationThirteen rules, each citing a real authority: ITIL 4, PAM/PIM, NIST 800-171 and CMMC. Raise only, so the model cannot talk an action down to routine. Fail closed, so an unruled action is Class 2.
Recorded before it runsA sealed row carrying the rule, the authority, the prompt version, the model, the cost and the human if one approved. A record written after the fact misses the run that executed and then crashed.
Executed, or refused to a humanClass 1 runs. Class 2 raises a protocol-level elicitation naming the approver. verify() walks the chain and names the row where it parts.