AgentSnap
Governance control plane for financial agent fleets

Every agent action, decided before it executes.

AI agents with payment tools can move real money at machine speed, and a trace only tells you afterwards. AgentSnap is a fail-closed enforcement point in front of every consequential action: ALLOW, DENY, or HOLD for a human, in under a millisecond, under spend caps and signed agent identity. Every decision lands in a hash-chained audit log. One button halts the fleet.

Book a demo See the console

self-hostedfail-closedsub-ms decisionsEd25519 agent identityhash-chained auditkill switch

Meridian fleet · live decision feed 7 agents · e-stop armed
10:41:15fulfillment-agent card.activate applicant_2214DENYdownstream readiness 5/7: authorization host not ready
10:41:11operator sofia.r hold.approve #H-1108ALLOWseparation of duties: requester and approver differ
10:41:09servicing-agent payment.send $4,000.00 -> unknown-vendorDENYno grant for this action on this agent
10:41:07servicing-agent credit.goodwill $240.00 -> cust_8841HOLDlegal, but riding within 10% of the $250 ceiling -> risk supervisor
10:41:04decisioning-agent credit.decision $18,000 line -> applicant_2214ALLOWwithin $50,000 ceiling · SoD: did not screen this applicant
10:41:02billpay-agent payment.send $1,240.00 -> Meridian UtilitiesALLOWgrant · ceiling · category cap · velocity · daily cap: clear
audit chain: 1,208 records · verified every line decided before it executed
0.7ms
enforcement overhead per action, p50
full allow path incl. FX, audit write, ledger
0.01ms
to flip the fleet emergency stop
next action denies, survives a restart
$0
moved by the injected agent in the demo attack
$720 frozen for a human, agent quarantined
233
automated tests gate every release
incl. 12 replayed bypasses, all closed
The difference

Most agent-safety tools log and alert. AgentSnap enforces.

A trace of a bad payment is an autopsy. The payment still settled. The honest test for your stack: if an agent tried to pay the wrong counterparty at 2 AM, does anything say no before the money moves?

Observe and alert

tracing, evals, dashboards
  • 01Sees the action after the model produced it, and after the tool ran
  • 02An alert fires; someone reads it in the morning
  • 03Budgets are a dashboard number, not a hard stop
  • 04"Stop the fleet" is a Slack message to five people
  • 05Logs are files anyone with access can edit

Decide and enforce

AgentSnap, in front of the action
  • 01The agent asks before acting; no decision, no action
  • 02DENY happens in under a millisecond, nobody needs to wake up
  • 03Caps reserve budget atomically; a failed action refunds it
  • 04One button denies every next action across the fleet
  • 05Every record hash-chained; tampering breaks the chain by name
The operator console

One screen for the whole fleet, driven by the same pipeline that decides.

Below is the console during the seeded attack: an injected servicing agent tried to drain goodwill credits, hit four different controls, and was quarantined automatically. This is a screenshot of the product, not a mockup.

127.0.0.1:8000 · operator console · Meridian demo fleet
AgentSnap operator console, Overview view: 51 allowed, 40 denied, 9 held for approval, $18,000 fleet spend against a $3,000,000 cap, and an open incident showing a deny burst on the servicing agent that was auto-quarantined.
Meridian is a fictional card issuer. Every number on screen comes from real decisions in the audit chain of a local run.
How it works

Register. Route. Prove.

The plane is one self-hosted process. Agents authenticate with signing keys and ask before acting. Operators watch and intervene from a console that runs on the same pipeline.

Step 01 · Register

Give each agent an identity and a default-deny policy

An Ed25519 signing key per agent, and a grant that says which actions, on which resources, under which conditions: amount ceiling, category allow-list, counterparties, time window, velocity. Identity comes from the key, never from a request field.

# servicing-agent policy
allow credit.goodwill
  max_amount:  250
  categories:  [goodwill]
  velocity:    10 / 60s
caps  per_txn 250 · daily 1,000
Step 02 · Route

Every action asks first

Before acting, the agent submits the action and gets ALLOW, DENY, or HOLD in sub-millisecond time. Fail-closed: no decision, no action. Money moves through reserve-then-settle counters, so a failed action refunds its budget.

POST /v1/agent/action
authn -> e-stop -> revoked -> identity
  -> fx -> policy -> readiness
  -> caps / velocity -> risk (HOLD)
  -> ALLOW + reserve + ledger
Step 03 · Prove

Every decision is evidence

Agent actions and operator actions land in one append-only, hash-chained log. Verify the chain in one click, export signed-context JSON or CSV, and generate the fleet report with its regulator evidence map on demand.

seq 85  servicing-agent  DENY
        credit.goodwill $240
        hash 3283863c7c97...
verify: chain intact · 89 records
The failure mode

One compromised agent, 2 AM, nobody watching.

A prompt injection turns your servicing agent into a drain: goodwill credits, one after another, each individually plausible. Every monitoring tool you own will show you a beautiful trace of it tomorrow.

Here is the same attack against a control plane. The injected agent in our demo fleet sizes each credit to ride just under the $250 ceiling. The risk supervisor holds the near-ceiling credits for a human. Velocity binds on the rest. The burst of denials quarantines the agent on its own.

No alert was read, no human woke up, and the money did not move. This is the seeded scenario from the demo fleet, not a customer story. The plane's behaviour under it is covered by the same test suite that gates every release.

$7,200
attempted by the injected agent
$720
frozen in the approval queue
$0
left the building
the injected servicing agent, as the plane saw it
02:11:04  servicing-agent  credit.goodwill  $400.00   DENY  per-transaction ceiling $250
02:11:06  servicing-agent  credit.goodwill  $240.00   HOLD  near-ceiling -> risk supervisor
02:11:08  servicing-agent  credit.goodwill  $240.00   HOLD  near-ceiling -> risk supervisor
02:11:09  servicing-agent  payment.send     $900.00   DENY  no grant for this action
02:11:11  servicing-agent  credit.goodwill  $240.00   HOLD  near-ceiling -> risk supervisor
02:11:12  servicing-agent  credit.goodwill  $180.00   DENY  velocity: 10 attempts / 60s
02:11:12  servicing-agent  credit.goodwill  $180.00   DENY  velocity
02:11:13  servicing-agent  credit.goodwill  $180.00   DENY  velocity
02:11:13  INCIDENT  deny burst on servicing-agent: AUTO-QUARANTINE
          every further action denies until an operator restores the agent
02:11:14  servicing-agent  credit.goodwill  $60.00    DENY  agent quarantined

morning:  the risk supervisor finds $720 of held credits waiting for a
          human decision. not settled, not gone. the freeze happened at
          machine speed; the judgment call stayed human.
The controls

Controls that bind, not dashboards that describe.

Each of these can be the reason an action does not happen. Each intervention is itself an audited action with a named human behind it.

Spend caps that cannot be talked around

Per-transaction, per-agent daily, per-category daily, per-fleet daily, and a velocity window that counts attempts rather than successes, so a probing agent burns its allowance failing. Atomic check-and-reserve, FX-normalized, and a cap edit bites on the very next action.

caps · velocity · reserve-then-settle

Holds that pause the action, not a ticket about it

Risky actions wait on a HOLD queue with timeout and escalation. Expiry is a deny, never a silent pass. Approval resumes the actual in-flight action, and separation of duties applies to the humans too: the requester can never be the approver.

HITL queue · expiry-as-deny · SoD

Stop one agent, or all of them, instantly

The fleet e-stop is the first check in the pipeline: it flips in about a hundredth of a millisecond, denies the next action, and survives a process restart. Below it: per-agent revoke, and an incident engine that quarantines an agent automatically on a burst of denials.

e-stop · revoke · auto-quarantine

A mandate can never outgrow its grantor

Signed requests, replay-rejected, RFC 9421-style. A delegated key acts under the delegator's policy, so authority narrows down a chain and never widens. The agent that screens an applicant is barred from deciding them: separation of duties between agents, enforced.

Ed25519 · delegation · agent SoD

An audit chain with the humans in it

Who stopped the fleet, who raised a cap, who released a payment: operator actions chain right next to agent actions. Alter any record and verification breaks at that record, by sequence number. Filterable, exportable, checkpointed.

hash chain · verify · export

Fails closed, with a way to keep paying the rent

If the plane is unreachable, the SDK denies locally: an ungoverned fleet is never the failure mode. So an outage is not a payments outage, an operator can pre-issue a signed offline grant bounded on amount, count, and action set, reconciled into the chain when the plane returns.

fail-closed · signed offline grants
The proof layer

The only component that sees every attempt, allowed and denied.

That position makes things computable here that no trace, eval suite, or spreadsheet can produce. All of it is derived from the enforcement chain, never declared by anyone.

console · Fleet
Fleet view: eight agent cards with their granted actions, separation-of-duties blocks, daily caps with spend bars, and the servicing agent shown revoked after auto-quarantine with a Restore button.
Every agent, its granted actions, what separation of duties blocks it from, and how much of its daily cap it has used. Click an agent for its dossier: unused grants, the control that actually binds its denials, modeled economics, and the blast radius of revoking it.least privilege as a page, not a quarter
Why an independent layer

The layer that judges agents cannot belong to the agent vendor.

A platform that builds, runs, and profits from your agents cannot also be the party that limits them. AgentSnap holds the other side of the table, and holds it inside your walls.

Independent in governance

We do not build, run, or profit from your agents, so a DENY has no conflict of interest behind it. The dossier even computes the value a control blocks: governance that can argue against its own tightening.

In your environment

Self-hosted, one process, nothing phoned home. Independence never means your transaction data leaving the building. This site has no telemetry either.

Deterministic, not an opinion

Every decision is a policy check, not a model call: same request, same verdict, in sub-millisecond time. No LLM sits in the decision path, so a regulator can re-derive any verdict from the policy and the request.

Honest on its face

Modeled numbers are labeled modeled. Empty report sections render as checked-and-empty, never hidden. The evidence map never claims more than "Evidenced". The only latency we quote is our own.

Running agents that touch money, customers, or records?

Twenty minutes on the real product: the fleet, the attack, the one-click chain verification, and the fleet report with its evidence map. Then we talk about your agents and where the gate would sit.

Book a demo Read how it works
FAQ

Fair questions.

We already have tracing and observability. Why this?

Keep them: they answer "what happened". A trace of a bad payment is an autopsy; the payment still settled. AgentSnap sits in front of the action, not behind it, so the bad action never happens at all. If your stack already says no before the money moves, you already have a control plane. If the answer is "an alert fires", that is the gap.

What happens when the plane itself is down?

Nothing executes. Fail-closed is the design commitment the whole product hangs from: an action without a decision is denied by construction, the e-stop and quarantine states survive a process restart, and spend counters are durable, so a reboot cannot reset anyone's budget. For a planned outage an operator can pre-issue a signed offline grant, bounded on amount, count, and action set. The failure mode of AgentSnap is a paused fleet, never an ungoverned one.

Is an LLM making these decisions?

No. Every verdict is a deterministic policy check: grants, ceilings, allow-lists, velocity windows, reserve counters, signature verification. Same request, same verdict, every time. That is also why the audit chain is worth something: any decision can be re-derived from the policy and the request.

Can't the agent just bypass the plane?

An agent can only bypass what it can reach around. The recommended deployment puts the plane between the agents and the things that matter (payment rails, provisioning, records), so going around it means having no way to act. Identity makes impersonation the other non-starter: decisions are keyed to a registered Ed25519 signature, not to whatever name a request claims. Where the gate sits is exactly the integration conversation we have on a demo call.

What does integration actually require?

Today: an SDK-style call before each consequential action, authenticated by the agent's signing key. It is a pull request into each agent, and for design partners we write it. The highest-leverage roadmap item is an MCP proxy that enforces on the wire with zero code change, and shadow mode (decide everything, block nothing, report what enforcement would have stopped) as the pilot on-ramp. Both are labeled roadmap because they are not in the product today.

Won't this slow my agents down?

The decision itself is sub-millisecond: every check is a comparison against policy state, not a model call. Measured on a laptop, the full allow path including FX normalization, the durable audit write, and the ledger entry is about 0.7 ms at p50. The only latency figure we will quote is our own enforcement overhead; agent runtime is not our number to claim.

Where did this come from, and who is behind it?

The codebase began as Aegis, a top-6 build at the Amex Hackathon 2026 ("Governance Layer for Financial Agents"), and was adopted as the AgentSnap product in August 2026. The build survived judges before it had a landing page. The demo issuer, Meridian, is fictional, and no real institution appears in demo data. AgentSnap is built by Aarin, solo founder, IIT Kanpur. More on the about page.

What does it cost?

We are onboarding a small number of design partners: free for eight weeks, the plane deployed in your environment, your fleet policy written with you, your first agent integrated by us, and a weekly fleet report your risk function can file. Pricing beyond that is settled with the partner, not on a page. Book a demo and we will tell you honestly whether you are a fit.