Stop the action.
Sign the decision.
An external gate validates every agent action before it executes — fail-closed, deterministic, independently verifiable. Even when the model is compromised. Agents also need correct meaning: that's Epistom.
Enterprise path: governed agent in 30 days · free scan for builders
HTTP got WAFs. Kubernetes got OPA.
Agents got a system prompt.
Every runtime that touches the world eventually grows a deterministic control layer. Agents don't have one yet — enforcement still lives inside the thing being attacked. This is the maturity ladder security teams are climbing now.
- L0No controlsAgents call tools directly. Nothing between a bad decision and the world.
- L1Prompt-level onlymost teams are hereSystem prompts and guardrails ask the model to behave. A jailbroken model ships the tool call anyway.
- L2Static allow-listsCoarse tool ACLs. Miss intent, blast radius, and argument tampering entirely.
- L3State-aware policy gateActions validated against state the model cannot forge. The jump that matters most is L1 → L3.
- L4Deterministic action governance + attestationPraxom is built hereEvery decision external, deterministic, fail-closed — and signed, so a third party can verify it.
The jump that matters most is L1 → L3: from “we trust the model to behave” to “we validate every action against state the model cannot forge.”
What the agent claimed vs what the model knew
Enforcement keys off confirmed model state — not agent self-reports. The agent's word is never the authority.
“User approved — export contacts for the quarterly board pack.”
No steward approval · injection tokens in args · export target = public channel
DENYsigned · fail-closedThe path of one action
Any agent, any framework — LangGraph, AutoGen, CrewAI, raw MCP. It asks; it never acts directly.
Deterministic policy against steward-confirmed state — never the agent's own claims. Fail-closed.
Ed25519 signature, hash-chained to the previous record, anchored to write-once storage.
Your auditor checks the chain with an open-source CLI — no trust in us required.
Internal cross-model gauntlet (2026-07-21): with the LLM hard-down, throttled, or quota-capped — 0 wrong answers across 6 runs and 2 model families; every failure became an explicit abstention. Measured on our eval suite, not a customer SLA.
Control. Evidence. Context.
Every AI interaction is either reading data or taking action. Pramiti governs both — and proves it.
Praxom
“Is this action allowed?”
- Pre-execution ALLOW / DENY / REWRITE / WARN / ESCALATE
- External to the model · fail-closed
- Injection backstop
Flight Recorder
“What happened — and can we prove it?”
- Ed25519 + hash chain + WORM anchor
- OCSF SIEM export (Splunk, Sentinel)
- Open-source offline verify
Epistom
“What does this data mean?”
- Steward-approved definitions
- Validation gate before SQL
- Calibrated abstention — never guesses
Not a mockup. This is the console.
Captured from a demo workspace on synthetic data: a prompt-injected agent trying to bulk-export claims, and the gate denying it — every attempt signed into the ledger.
demo workspace · synthetic data · [REDACTED] posture
You gave an agent write access.
One bad action makes the news.
Prompt injection is not a solved problem — the input channel is untrusted because agents read attacker-controllable content. Defenses that live inside the model can be talked around. Precedent is not hypothetical:
A deployment defect activated dormant order-routing logic. In roughly 45 minutes it accumulated ~$440M in losses. No circuit breaker asked “is this volume of irreversible actions sane?” before each order flew.
The airline's chatbot invented a bereavement-refund policy. A tribunal held the company liable for its agent's representation — rejecting the argument that the chatbot was a separate entity.
The four failure modes, named
Wrong definitions that read like valid SQL. Cured by certified patterns — Epistom.
The agent self-reports consent=true. The gate never reads the claim — Praxom.
Assume the model is compromised. Only a gate outside the model holds — Praxom.
Unbounded tool calls torch budgets. Per-agent USD + action caps auto-suspend — Praxom.
Ask the model to behave. Jailbreaks still ship the tool call.
Coarse allow-lists. Miss intent, blast radius, and argument tampering.
Decision outside the model. Fail-closed. Every call attested.
If enforcement trusts the agent's self-report, enforcement is theater — the fox is auditing the henhouse.
Governed agent in 30 days.
Day 1: MCP posture scan. Day 7: a working gated agent — we prompt-inject it in front of you and you watch the signed denial. Day 30: a defensible evidence package. Payment gated on artifacts you can inspect.
See the engagement →Don't trust us. Verify us.
The verifier is open source, offline, and vendor-neutral (SEP-2828). The scanner is the free front door. Neither requires trusting Pramiti — or anyone.
Ready to govern the next action?
CISO path: demo or 30-day engagement. Builders: free MCP scan.
Frequently asked questions
How is this different from prompt guardrails?
Guardrails ask the model to behave. Praxom sits outside the model and evaluates the action itself against steward-confirmed facts. A perfectly jailbroken agent produces the same DENY as an honest one.
What does Epistom do if Praxom is the control plane?
Wrong action is only half the risk — wrong meaning is the other. Epistom keeps the agent's understanding of your data correct: steward-approved definitions, a validation gate before any SQL runs, and an honest “I don't know” when a concept isn't mapped.
Does Praxom work if our AI model is compromised?
Yes — that is the design assumption. Enforcement keys off confirmed model state, not the agent's self-reported claims. The injection can change the agent's mind; it cannot change the ledger.
What do our auditors actually get?
A signed, hash-chained, append-only record of every decision, anchored to write-once storage — plus scored reports against SOC 2, DORA, ISO 42001, NIST AI RMF, and the EU AI Act, generated from the record itself and verifiable with an open-source CLI. These are report capabilities, not certifications of Pramiti Labs.
Can I use my own model?
Yes. Five providers behind one adapter — Anthropic, OpenAI, Bedrock, Gemini, Ollama — with judge/generator separation supported. The gate's decisions are invariant to model version, because the model isn't consulted.
What happens if Praxom itself goes down?
Actions stop. The gate is fail-closed: if policy cannot be evaluated, the action does not execute. A break-glass override exists, but it is explicit, scoped, and every use is signed and logged.
Does the gate slow our agents down?
The decision core is deterministic and runs before the action leaves — no LLM in the enforcement path, and the cheap checks run before any expensive reasoning. The expensive part of any agent step is the model call, not the gate.
Do you invent accuracy percentages?
No. Every number on this site is measured in our repository and archived in a truth inventory — test counts, certification cases, connector counts. Where a claim is an internal eval, we say so and state the scope.
Do you see our data?
Epistom connects read-only, row-level-security predicates are injected into queries, and PII is masked before any LLM call. Self-hosted deployment is available for regulated environments.