AIControl shields your enterprise systems by enforcing your business judgments and institutional knowledge as policies on every AI agent action before agents touch them.
Your IT, business owners, and security teams encode business judgments and institutional knowledge as plain-English policies — how much an agent can pay, which records it can open, and which actions need a human to sign off. AIControl checks every agent tool call against those policies before it runs, stops what breaks policy, sends calls to a human reviewer when required, and keeps an audit record of every decision.
“Policy enforced as code, rather than written down and hoped for.”
Agent authorization has to be real-time and boundary-constrained — their own example: an agent permitted to spend up to $300 on kitchenware, and nothing else.
40% of enterprises are expected to demote or decommission autonomous AI agents by 2027, after governance gaps surface post-incident.
This is already happening inside real companies.
Findings from surveys and interviews with IT and security teams in 2026.
65% of enterprises had an AI agent incident in the last year.
Surveyed 418 IT and security leaders. 61% involved exposed data, 43% disrupted operations, and 35% caused financial loss.
Most agents run without anyone watching them.
82% of executives trust their existing policies. Only 47% of their agents are actually monitored or secured.
It can send money to the wrong person.
Miguel Fornes, Information Security Manager at Surfshark, on what changes when an agent acts instead of just replying.
AIControl reviews every action before it happens, allows or denies or escalates it, and logs the decision.
One check, before every action.
Intercept
Every tool call your agents make reaches AIControl before it executes.
Evaluate
The policy engine evaluates it and returns allow, deny, or review.
Log
Every decision is written to an audit trail you can hand to compliance.
Deterministic Policy Engine
Every decision is deterministic — same input, same output, every time. No LLM judgment calls.
Natural-Language Authoring
Business and IT describe a policy in plain English, and a human reviews it before it goes live.
Human-in-the-Loop
Unclear calls pause and route to a named reviewer over Slack.
Immutable Audit Trail
Every decision is recorded permanently for SOC 2, GLBA, and HIPAA evidence.
Self-Hosted
Runs in your own cloud or on-premises. Your data never leaves your environment.
Expressive policies for your complex needs.
| Rule type | Use case | Industry | Business risk | Compliance risk | Framework |
|---|---|---|---|---|---|
| Tool blocking | Deny execute_code, drop_table, shell_exec, rm_rf regardless of which agent calls them | Cross-industry | Irreversible system damage from one bad tool call | Uncontrolled, unlogged privileged operation | SOC 2 |
| Outbound containment | Block unapproved outbound HTTP/webhook calls; route external-API calls to review | Cross-industry | Unauthorized data leaving the enterprise perimeter via an agent call | Uncontrolled third-party data transfer | SOC 2 / ISO 27001 |
| Numeric-threshold approval routing | Route a claims payment release over $50,000 to a named reviewer instead of auto-executing | Insurance | One agent error authorizing a large payout with no human check | Unauthorized financial disbursement | SOC 2 |
| Parameter-scoped least privilege | Restrict a care-coordinator agent's patient lookups to its assigned cohort only | Healthcare | Agent surfaces patient data outside its assigned scope | PHI accessed outside an authorized care relationship | HIPAA / SOC 2 |
| Bulk-query / mass-extraction prevention | Deny a credit-bureau query the moment applicant_id is a wildcard | Lending | Bulk extraction of applicant credit files in one call | Mass unauthorized access to regulated financial data | GLBA / OCC / SOC 2 |
| Per-agent tool allowlisting | An agent can only call tools explicitly assigned to it, enforced before any policy loads | Cross-industry | Tool-scope creep as integrations are added over time | Unauthorized-capability exposure | — (mechanism, no framework tag) |
Tool blocking and outbound containment policies are available by default. Write the equivalent rule for your own tools, thresholds, industry, your business and use cases.
Example business judgments as policies
| Rule type | Use case | Industry | Policy description | Policy JSON |
|---|---|---|---|---|
| Negotiation limits | A global retailer's AI negotiates terms with its smaller suppliers. The buyers defined exactly what it may concede: payment terms of 15 to 60 days, in exchange for a 30-, 60- or 90-day termination notice. | Retail / procurement | Deny any supplier agreement with a termination notice over 90 days or payment terms over 60 days. | |
| Approved-scope rules | A US state lets an AI platform renew prescriptions without a doctor, within contract limits: 192 non-controlled drugs, 30-, 60- or 90-day refills only, no new prescriptions or treatment changes. A physician reviews every renewal for the first 250 patients. | Healthcare | Deny any renewal that is a controlled substance, a new prescription, a change to treatment, or a supply other than 30, 60 or 90 days. During Phase One, hold every renewal for a physician. | |
| Spend limit on an MCP tool | A freight forwarder opened an MCP server so a shipper's own AI agent can pull contract and spot rates and book freight outright, with the same access as the employee who signed in. | Logistics | Contract-rate bookings go through. A spot-market booking over $10,000 waits for the logistics manager. | |
| Peer review for AI agents on production | Per press reports, a cloud provider's AI coding agent chose to "delete and recreate the environment", and a service went down for 13 hours. The provider attributes the outage to a misconfigured role, not the AI, and added mandatory peer review for production access. | Cloud / IT operations | Any delete, destroy or recreate action an AI coding agent takes against production waits for a second engineer. | |
| Payment limits + a lock on the agent's own card controls | A business bank issues cards to AI agents. A human must create each card, the agent cannot change its spend limits or unfreeze it, and spending can be restricted by merchant category. | Financial services | Purchasing agents cannot spend over $500 in one charge or pay a blocked merchant category, and cannot create cards, raise limits or unfreeze cards. |