Named agents
Every AI agent is registered with a governed identity. It is assigned to a team or department and bound to a named person who is on record for every decision the agent makes.
The product
Three things that make AI agents accountable.
Every agent has a governed identity. Every action is checked before it runs. Every decision leaves a record that cannot be changed. These three things work together, in your own environment.
CLAIIM Gate
agentsupport-bot
ownerr.okafor · support lead
teamcustomer support
ALLOWsend customer reply
DENYissue refundneeds human approval
Chronappend-only proof
09:12:44ZALLOWsend customer reply
09:12:51ZDENYissue refund
owner: r.okafor · policy: support-policy-v2 · team: customer support
Three parts. Working together.
Policy before action
Every agent action is checked against your rules before it runs. CLAIIM returns ALLOW or DENY with a reason. Nothing touches a system without that check.
Tamper-evident proof
Every ALLOW and DENY is written to your audit log before the action completes. The record lives in your environment, is append-only, and cannot be edited or deleted.
Ungoverned versus accountable.
The same agent. One path has a governance layer. One does not.
Without CLAIIMungoverned path
Agentdeploy-bot
direct API call
External serviceproduction API
action executes
Audit log (after the fact)no proof of authorization
xNo proof an action was authorized
xAny agent with credentials can act
xLogs appear after damage is done
With CLAIIMgoverned path
Agentdeploy-bot
gate request
CLAIIM Gateidentity + skill + policy
ALLOWdeploy:stagingDENYdeploy:production
proof recorded first
Chronappend-only proof
anchors.kondepudipolicyprod-deploy-v3
+Human anchor on every decision
+Policy checked before execution
+Proof exists before action completes
What happens when an agent acts.
Every action goes through this sequence before it reaches any system.
01
The agent sends a request
When an agent wants to take an action, it sends a request to CLAIIM before touching any system. The request includes the agent identity, the intended action, and the scope it is operating in.
02
CLAIIM checks identity and scope
CLAIIM confirms the agent is registered, that it belongs to the team or department it claims, and that it is operating inside its assigned boundary.
03
The action is matched against policy
The action is evaluated against the active policy set for this agent. CLAIIM checks whether it is allowed, blocked, or held for a person to approve.
04
ALLOW or DENY is returned immediately
CLAIIM returns a decision before the agent touches anything. An ALLOW lets the action proceed. A DENY stops it. The reason is always included.
05
The record is written before the action completes
The decision, agent identity, responsible person, rule version, and timestamp are written to Chron immediately. The record exists before the action runs.
Every Chron entry contains:
agent
Which agent sent the request and what it claimed to be doing.
owner
The named person in your team who is on record for this agent.
decision
ALLOW or DENY, with the reason returned to the agent.
policy version
The exact rule version in effect at the time. If rules change later, the record shows what applied.
Runs in your infrastructure. Maps to how your teams work.
CLAIIM deploys in your own environment. Every component stays inside your infrastructure. No agent data, decisions, or audit records leave your environment.
What runs in your environment
The gate
Receives action requests from your agents and returns ALLOW or DENY before anything runs. Deployed in your own infrastructure. No request leaves your network.
Policy store
Holds the rules for each agent and scope. Every change creates a new version. Policies are versioned so silent edits are not possible.
Chron
The append-only audit log. Every gate decision is written here. Records stay in your own database under your control.
Identity registry
Holds registered agents, their team and department assignments, and the responsible person bound to each agent.
How it maps to your teams
Teams and departments are the boundary
Agents are assigned to a team or department. They cannot act outside that boundary unless a separate policy allows it. Finance agents stay in finance. Engineering agents stay in engineering.
A named person is on record for every agent
Each agent is sponsored by someone in your team. Their name travels with every gate decision. Accountability is always traceable to a real person.
Policies belong to the team that owns the agent
Rules are set at the team or department level and apply only to agents in that scope. A change to finance policies does not affect engineering agents.
Sensitive changes need two people
Adding an agent, changing its boundary, or expanding its permissions requires a second person to approve before the change takes effect. Both approvals are on record.
Ready to govern your first agent?
Preview is free and runs in your own environment.