A deterministic cage around probabilistic intelligence.
Three planes working together: verified context for reads, deterministic enforcement for writes, and a cryptographically signed audit trail for everything in between.
Request a demoInternal cross-model gauntlet (2026-07-21): with the LLM hard-down, throttled, or quota-capped — 0 wrong answers across 6 runs and 2 model families; every failure became an explicit abstention. Measured on our eval suite, not a customer SLA. Compliance frameworks are scored report capabilities generated from the attestation record — not certifications of Pramiti Labs.
Every agent action passes one checkpoint
Intent and arguments are probabilistic. The action layer is where determinism takes over — before an effect reaches the world.
Three planes. One platform.
Praxom
“Is this action allowed?”
Intercept, validate, and enforce every agent action before it executes — even if the agent has been compromised. Enforcement lives outside the model.
- ALLOW / DENY / REWRITE / WARN / ESCALATE — decided pre-execution
- Ed25519-signed, hash-chained attestation store
- Fail-closed: no policy, no action
Flight Recorder
“What happened, and can we prove it?”
Every agent action recorded, cryptographically signed, and exportable in OCSF format. Immutable audit trail for EU AI Act, DORA, and SOC 2.
- Ed25519-signed, hash-chained records — independently verifiable offline
- OCSF export for SIEM integration (Splunk, Sentinel)
- Scored, PDF-rendered compliance reports
Epistom
“What does this data mean?”
Keeps the agent's understanding of enterprise data correct. Five trust tiers — deterministic paths answer first; the LLM only runs where it earns its place.
- Business knowledge model — steward-approved definitions
- SQL validation gate before any query executes
- Calibrated abstention — “I don't know” beats a wrong answer
The gauntlet every action runs
Nine slots, in this order, on every proposed action. Any slot can stop it. The whole path is deterministic and fail-closed — a jailbroken model changes nothing, because the model isn't consulted.
- Kill switchWorkspace hard-stop. Checked before identity, before anything — a killed workspace executes nothing.
- IdentityCaller resolved to a registered agent and trust tier — AWS IAM, Azure MSI, or SPIFFE workload identity.
- ScopeIs this tool inside the agent's granted task scope? Out-of-scope proposals stop here.
- LeasesA valid, unexpired task lease must cover the action. Expired lease, no action.
- BudgetsPer-agent USD and action-count ceilings. Budget-velocity spikes auto-suspend the agent.
- Tool pinThe tool schema must match the version that was reviewed — swapped or mutated tools are refused.
- Policy + taintBusiness rules evaluated deterministically — JSON predicates and formal SHACL shapes — with data-taint state feeding the decision so read-sensitive-then-exfiltrate paths are blocked.
- RewriteWhere policy allows with changes: cap amounts, mask fields, set safe defaults — the original preserved in the record.
- AttestEd25519-signed, hash-chained record of the decision. Every path through the gate ends here — allowed or not.
Two engineering invariants hold the pipeline together: the cheap checks run before any expensive reasoning — a deny never pays for reasoning — and every slot is synchronous and IO-free by design invariant.
How a question earns an answer
Five trust tiers, tried in order of certainty. Most questions never reach an LLM — and when nothing clears the confidence bar, the platform abstains instead of guessing.
How it fits together
# Data flow: agent request to audited execution AI Agent (Claude, GPT, Cursor — anything MCP) | +--> Epistom (Context Plane) | "What does this data mean?" | Verified definitions + SQL validation gate | +--> Praxom (Control Plane) | "Is this action allowed?" | ALLOW / DENY / REWRITE / WARN / ESCALATE | +--> Flight Recorder (Audit Plane) | Ed25519-signed + OCSF export | Immutable audit trail | v Database (read-only) | Action Targets (Salesforce, Slack, APIs)
Seven pip packages. Zero platform dependencies.
Core capabilities ship as independent packages — including the free MCP scanner and the verifier that lets your auditor check our work without trusting us.
Free OSS security scanner for MCP servers — see what your agents can already do.
live on PyPINeutral, offline verifier for signed execution records (SEP-2828). Your auditor checks the chain without trusting us.
live on PyPIInstall-time MCP guard — 130 real invocations, zero wrong verdicts in its ship-pass matrix.
ships with engagementsAgent action recorder with Ed25519 signing, hash chaining, and OCSF SIEM export.
ships with engagementsPer-agent warehouse cost caps and tool-call budgets — the loop-stopper.
ships with engagementsPush semantic models to GitHub, GitLab, or any webhook ingestion endpoint — hash-based change detection.
ships with engagementsReconciles two companies' knowledge models for M&A data integration.
ships with engagementsPlus the epistom-agents SDK — guard decorators for LangGraph, AutoGen, CrewAI.
Ready to govern the next action?
30-minute demo. See Epistom and Praxom on your own data.