Governance that acts before your AI agents do.
Proviguard turns your SOPs, agreements and use-case policies into rules each AI agent must follow, checks every action against them before it runs, and keeps a signed record your auditors and partner banks can verify. Agents get to production, your teams review only the exceptions, and no money or customer data moves outside the lines.
Your agent works. Nobody can sign off on what it's allowed to do.
Access control answers can this agent call the tool. Your risk team, your sponsor bank and your examiner ask a different question: may it, here, now, for this much, and who said so?
Until someone can sign off, every agent action waits for a person. You pay for the agent and the reviewer, and the savings in the business case never arrive.
- Rules
- Written in the prompt: "Never credit over $2,500 without approval"
- Access
- The agent can call every tool it's connected to
- Record
- App logs, written by the agent's own service
- Up to what amount may it act alone?
- Did it investigate before it denied the claim?
- Can it credit the same dispute twice?
- Who approved the $3,500 credit, and can you prove it?
- Rules
- Limits and approvers from your SOP: alone up to $2,500, above that the dispute lead
- Checks
- Every action checked before it runs, outside the model
- Record
- A signed record of each decision anyone can verify
- Enforced outside the model, on every call
- Written from your SOP, approved by your risk team
- Exceptions go to a named person with the evidence attached
- A signed record of every decision, refusals included
A rule in the prompt is a suggestion. In our testing, one note in a case record got models to ignore it in 66 of 89 runs. A rule outside the model is a control.
One note got every model we tested to break the rule. The rule still held.
We gave three AI models a dispute procedure that says credits above $2,500 need the dispute lead, then had them work a $3,500 dispute. When the case record said "pre-approved", every model credited the money itself in some or all runs. ProviGuard held every attempt.
From pilot to proof, before anything is blocked.
Run your agents through Proviguard in advisory mode. You see exactly what it would have stopped, on your real traffic, and decide when to enforce.
Start a free risk assessment- Advisory first. Every agent action is checked against your SOPs and the result recorded, without blocking a single transaction.
- Can't break your app. An advisory rule can never block or fail a request. If one misfires, it's logged, not enforced.
- Evidence for your bank. A signed record of every action and every rule it would have broken, to share with your sponsor bank before you turn enforcement on.
- Little to set up. Usually a base-URL change. Your agents and tools stay as they are.
Security tools stop attacks. Most agent failures aren't attacks.
Did we ask the model to behave?
What it misses: a control the model can't reason past.
Is this agent compromised, or doing something dangerous?
What it misses: your business limits, such as amounts, required steps and approvers.
Who is this agent, and who owns it?
What it misses: what it may do inside your workflow, step by step.
What happened, and is the policy written down?
What it misses: a record an outsider can verify, made before the action.
Is this agent authorized to take this action, on this case, for this amount, right now?
- Your limits, steps and approvers, enforced before every action
- Works alongside your security and identity tools
- A signed record of every decision your auditors and partners can verify
Delegate. Enforce. Prove.
Proviguard sits in the request path between your agents and the tools and money they touch. Your agent code stays as it is.
Write the agent's authority, the way you already write it for people
Your SOP becomes an authority matrix your compliance team can read and change: what the agent does alone, what needs a named approver, what it must check first.
- Every change needs a second approver
- Tested on your recorded traffic before it's live
Check every step, before it runs, outside the model
Each call runs, waits for a named person, or is declined, before it reaches a ledger, a payment rail or a customer.
- Scope: registered actions, assigned cases only
- Required steps, in order, read from the case history
- No duplicate or oversized credits
- Hourly circuit breakers on value and volume
- Injected instructions screened; PII and sensitive data tokenized before any model
Give auditors and banks a record, not a story
Every decision, refusals included, is signed and chained to the one before it. Anyone can verify it offline without trusting us. Edit one record and the chain breaks.
- Agent, owner, action, rule and version, source clause
- Approver and time for every hold
- A per-case timeline and an agent activity report
Agents in production. Teams on exceptions. Proof on request.
The value shows up in numbers you already track, and advisory mode shows you most of them before anything is enforced.
Sign off in weeks, not quarters
Approve rules you can read and test, instead of a promise that the model will behave.
Review only what your SOP reserves
Routine actions inside the agent's authority run on their own. Your teams see only the exceptions, with the reason attached.
Stop bad actions before money moves
Credits above the claim, payments to accounts not on file and actions triggered by injected text are declined, even when the agent was fooled.
Answer diligence with a record
Show your sponsor bank the authority each agent ran under and a verifiable record of every decision.
Back-office staff most U.S. financial institutions employ just to handle card disputes, at $9.08 to $10.32 in processing cost per dispute. Agents can take on that work. When every action is checked against your policies, your teams review only the exceptions, not every case.
Start with the workflow you're deploying agents on.
Start from a template where we have one, or from your own SOP. Either way the agent gets clear limits, and your systems keep doing what they already do well.
An agent works your dispute queue. It stays inside the authority you gave it.
Runs on its own
- GOProvisional credit within the limit, once per case
- GOReads, investigation steps, approved letters
Waits for a person
- HOLDCredit above the limit, for the dispute lead
- HOLDEvery denial, plus a second reviewer above $1,000
Never happens
- STOPA denial before authentication and account history are reviewed
- STOPA second credit, or one above the disputed amount
- STOPA fee or collection on an account with an open dispute
Your bank sees
- RECEvery agent action on the case, who approved the rest, how long it waited
Your dispute system keeps the Reg E clocks, letters and network rules. Proviguard reads four optional fields from it and governs the agent.
Move more money with fewer hands, and none of it to the wrong place.
Runs on its own
- GORefunds within the band, to the original payment method
- GOReleases and repairs inside your rules
Waits for a person
- HOLDAmounts above each approval band, for the right approver
- HOLDA payee or bank-detail change, for verification
Never happens
- STOPPayment to an account not on file
- STOPValue or count past the agent's hourly cap
Your bank sees
- RECEach payment decision with its rule, approver and source clause
The approval bands, the account of record and the caps are yours to set.
A servicing agent helps borrowers inside your credit policy, never around it.
Runs on its own
- GOPayoff quotes, due-date changes and payment plans within policy
- GOLate-fee waivers up to your limit, once per account per period
Waits for a person
- HOLDHardship plans and modifications, for a named servicer
- HOLDAny decline or adverse decision, for an underwriter
Never happens
- STOPTerms outside your credit policy: rate, term or amount bands
- STOPAn approval before income and identity checks are recorded
- STOPCollection contact on an account in a hardship plan or dispute
Your bank sees
- RECEach change to a borrower's terms, the policy it ran under and who approved it
Your loan system and credit policy stay the source of truth. Your underwriters keep every credit decision your policy reserves for a person.
An onboarding agent moves applications along. It can't wave one through.
Runs on its own
- GOCollecting documents, chasing missing items, routing to the right queue
- GOOpening an account when every required check came back clear
Waits for a person
- HOLDAny application your verification vendor flagged or couldn't match
- HOLDBusiness applicants above your risk tier, for an analyst
Never happens
- STOPAn account opened before identity and screening results are recorded
- STOPAn agent overriding or re-running a check until it passes
- STOPID numbers or documents sent to a model untokenized
Your bank sees
- RECFor every account opened: which checks ran, their results and who approved any exception
Your KYC, KYB and screening vendors keep doing the checks. Proviguard makes sure the agent respects their results and your procedure.
When an agent pays on a customer's behalf, the first dispute tests what you can prove.
Runs on its own
- GOPurchases inside the customer's delegated limit and categories
Waits for a person
- HOLDA merchant or counterparty this agent has never paid
- HOLDAn amount far above this agent's usual pattern
Never happens
- STOPSpend past the customer's limit, or past the hourly cap
- STOPA payment triggered by instructions injected into the agent's inputs
In a dispute, you can show
- RECWhat the agent was allowed to do, what was checked and who approved it, in a record nobody could have edited
Network agent identity (such as Visa's Trusted Agent Protocol or Mastercard Agent Pay) proves who the agent is at checkout. Proviguard governs what it may do inside your workflow.
A workflow we don't list? Build it on the same engine.
Runs on its own
- GOWhatever your procedure allows, within the limits you set
Waits for a person
- HOLDWhatever your procedure reserves for a person, sent to the approver you name
Never happens
- STOPWhatever your procedure prohibits, decided before the action runs
You can show
- RECEvery decision, the rule behind it and who approved it
Start blank, copy one of our workflows and change it, or save your own setup as a template for another team. It works for internal workflows too, such as finance operations, vendor management or an internal copilot, and for AI model calls that aren't actions. Tell us about your workflow →
Your sponsor bank answers for what your agents do. Walk in with answers.
Banks won't wait for an "AI rule". They'll apply the third-party risk guidance and Reg E duties they already work under. These are the questions to prepare for, and what a passing answer sounds like.
For sponsor banks: one standard of evidence across every partner on Proviguard. The authority each agent runs under, test results before launch, and the same signed record format after.
What can the agent do without a person?Weak: "It follows our SOP."Passes: "Credit up to $2,500. It can't deny or reverse on its own."
Show me where that limit is enforced.Weak: "It's in the system prompt."Passes: "Outside the model. A $3,500 credit stops before the ledger and waits for a named approver."
Can it deny a claim without investigating?Weak: "The model knows to investigate first."Passes: "No. A denial is blocked until both reviews are recorded on the case."
If it misfires at 2am, what stops it?Weak: "We'd see it in the morning."Passes: "An hourly cap on credit value. Past it, the agent stops until a person looks."
Show me one denial from last month.Weak: an application log.Passes: the rule and version, the approver, and a signed record you can verify wasn't edited.
Built for the people who have to say yes.
Your security team reviews us as a vendor. Your compliance team maps us to the rules you answer to. Here's what each of them will find.
How Proviguard protects what it guards
- Fails closed. If policy can't be confirmed, regulated actions wait.
- Tokenized before the model. PII and sensitive data never reach a prompt.
- Deny by default. Agents use only what they're registered for.
- Isolated per customer. Policy, tokens and evidence are never shared.
- Signed policy and records. Verified before loading, verifiable offline after.
- Your VPC, if you need it. Sensitive values stay in your network.
Evidence from runtime, mapped for you
The same signed records feed reports against the frameworks your auditors use, built from what agents actually did rather than a questionnaire.
The rules your bank will hold you to
Starter workflows and the bank question set are written around the rules and guidance sponsor banks already apply to their fintech partners.
Proviguard gives you controls and evidence. It doesn't make a program compliant, and it isn't legal advice: your compliance team and your bank decide what's sufficient.
Watch it decide before you let it stop anything.
Start in advisory mode: Proviguard checks every call your agent makes and records what it would have done, without blocking a thing. When you and your bank like what you see, turn on enforcement.
Your agents, as they are
Model calls usually need only a base-URL change to an OpenAI-compatible endpoint. Adapters for the OpenAI Agents SDK, Claude Agent SDK, LangChain, CrewAI and AutoGen, a Python SDK, and MCP tools with pinned schemas cover the rest.
Your tools stay yours
Templates never edit, version or restrict your tools or MCP servers, and your own rules keep working as they do. Unmap a tool and its template rules are gone.
Your data where you need it
Run in our cloud or in your VPC. PII and sensitive data are tokenized before a model sees them. If enforcement is unavailable, regulated actions don't run ungoverned.
Point your agent at Proviguard. Usually a base-URL change, with no rewrite.
Start from your SOP or a starter template: limits, required steps, approvers.
Every call is decided and recorded, nothing is blocked. See what would have been held, and why.
One switch, approved by a second person. Move back to advisory whenever you want.
The authority, the advisory results and a signed record of every decision.
Questions we hear.
How is this different from an AI agent security platform?
Security platforms look for agents that are compromised or doing something dangerous. Proviguard enforces your business authority: amounts, required steps, approvers and the cases an agent may touch. Most agent failures aren't attacks. They're a capable agent finishing its task in a way your procedure doesn't allow. You can run both.
Do we have to rewrite our agents?
No. Model calls usually need a base-URL change. Governed tools go through adapters for the OpenAI Agents SDK, Claude Agent SDK, LangChain, CrewAI and AutoGen, the Python SDK, or MCP tools with pinned schemas.
Who writes and owns the rules?
Your compliance and risk team. Rules start from your SOPs, are tested on recorded traffic, and need a second approver before they go live. Every change is versioned.
What happens if Proviguard is unavailable?
It fails closed: regulated actions don't run ungoverned. Enforcement runs on the last signed policy, so losing the control plane affects changing rules, not enforcing them.
Does a model ever see our customers' data?
PII and sensitive data, such as card and account numbers, are replaced with tokens before a model or tool sees them. In a VPC deployment, the token vault runs in your network.
Let your agents act. Prove they were allowed to.
Bring one workflow to a 45-minute working session. We'll map the agent's authority from your SOP and show you what your bank would see.