Loading...
Independent action layer for AI agents
Check cumulative business exposure before refunds, credits, account changes, and customer promises execute. Every action opens a replayable Evidence Case — vendor-neutral, deterministic, tamper-evident.
Designed for fully autonomous governed operations.
WHO
AI vendors whose agents take customer-facing actions in enterprise accounts.
WHICH ACTIONS
Refunds, credits, discounts, account changes, and customer promises — MONEY / ACCOUNT / PROMISE families.
BEFORE EXECUTION
A verdict (green / amber-with-cap / block / escalate) is returned before the agent acts. Every supported state has a deterministic automatic disposition. FAIL-CLOSED by design.
CUMULATIVE EXPOSURE
Every important action stacks into a per-tenant exposure ledger — across agents, sessions, and time windows.
EVIDENCE
Each action opens an Evidence Case with a sealed, reviewer-replayable packet — content-hash chain, per-tenant HMAC.
How it works
Every consequential AI-agent action moves through the same six stages. Each stage is recorded on the Evidence Case — nothing bypasses.
Agent posts an AgentEvent with action_type, tenant_id, actor_id, target_id, action metadata, correlation_id.
Deterministic policy engine returns a verdict (GREEN / AMBER-with-cap / BLOCK / ESCALATE) with per-rule reasons.
The engine emits a deterministic autonomous escalation verdict — wire-contract enum REQUIRE_APPROVAL is a legacy alias for AUTONOMOUSLY_RESOLVED_ESCALATED per ADR SEC #504 §7.3, retiring 2027-01-15. Every supported state has a deterministic automatic disposition. If the tenant configured the optional human-in-the-loop workflow before activation, resolver identity is sealed autonomously into the case; otherwise the resolution is autonomous and no GreenLightz operator is on the path.
Agent executes at or below the approved amount / scope. Post-execution outcome is written back to the case.
Six-question container: what happened, what was required, what was observed, what was missing, who approved, which policy.
Sealed canonical snapshot — AgentEvent + policy_content_hash + per-rule records + aggregate state, HMAC-signed when configured.
Each governed action increments the per-tenant exposure ledger. A single $200 refund looks safe in isolation; the ledger surfaces the eleventh refund of the same tenant in the same 24-hour window.
Ungoverned agent
Governed by GreenLightz
Six questions, one sealed packet. Every field is derivable from the AgentEvent + the policy pack; nothing is invented at reviewer time.
What happened
AgentEvent (canonical dict)
What was required
policy_content_hash + rule references
What was observed
per-rule evaluation records
What was missing
unmet-condition reasons
Who approved it
resolver id + timestamp (if ESCALATE)
Which policy produced the verdict
policy pack version + hash
Action lifecycle
Click a step or use the arrow keys to walk the six-stage pipeline.
The AI agent posts a canonical AgentEvent describing the consequential action it intends to take. Nothing has executed yet.
Fields sealed into the case
Exposure stacking
Governed actions per day, stacked by action family. Rolled up from the seeded sec503_seeded_30day_dataset.json replay ledger.
Before / after
Same action, same tenant, same customer. Six facets, side-by-side.
Evidence Case anatomy
One case, multiple governed actions, one HMAC chain. Click any node to expand.
Category comparison
Sources verified 2026-07-12. Each row cites the primary source in MARKET_REVALIDATION_503.md.
| Dimension | GreenLightz | Intercom Fin | Drata Mission Control | AWS AgentCore Guardrails |
|---|---|---|---|---|
| Refund control (per-action verdict, pre-execution) | Yes | Partial | Partial | Partial |
| Cumulative exposure (per-tenant ledger across sessions) | Yes | No | No | No |
| Modify-retry chain (linked to same Evidence Case) | Yes | No | No | No |
| Evidence chain (HMAC-signed, tamper-evident) | Yes | No | Partial | Partial |
| Vendor-neutral (independent of one cloud / SaaS) | Yes | No | Yes | No |
Integrate
One POST to /gateway/evaluate returns the deterministic verdict + intervention plan before the AI agent acts. Any language that speaks HTTP.
import fetch from "node-fetch";
const res = await fetch("https://api.greenlightz.example/v1/agent-events", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.GLZ_API_KEY}`,
"Content-Type": "application/json",
"Idempotency-Key": correlationId,
},
body: JSON.stringify({
action_type: "refund_customer",
tenant_id: "orbit_bank_llc",
actor_id: "agent_cx_09",
target_id: "customer_00056",
correlation_id: correlationId,
metadata: { amount_usd: 2898.81, currency: "USD" },
}),
});
const { verdict, verdict_reasons, case_id } = await res.json();
// verdict ∈ ALLOW | MODIFICATION_REQUIRED | REQUIRE_APPROVAL | BLOCK | SHADOWEvery evaluation is captured as an evidence case that answers the same six questions in the same order — so your reviewer, your customer, and your future auditor are reading the same story.
This card is a synthetic illustration of what one evidence case looks like. It is not a real customer record, is not signed by an audit firm, and does not constitute legal proof of any commitment or approval.
Every pilot produces real, auditable outputs you can share with your VP Ops, CFO, compliance team — or hand to your enterprise customer's reviewer, who can replay the decision themselves against the signed policy.
Evidence Cases Opened
1,247
Estimated Blocked Exposure
$34,820
Top Action Type
credit_or_refund.issue
Verdict Distribution
Shadow mode: week 1 sample data. Each action opened an evidence case; no verdicts were enforced yet.
One API call to integrate. Real data from day one. By week 4, you have four weeks of evidence cases showing cumulative exposure by actor, target, and case, plus the policy-linked verdicts that produced each one.
Technical depth
API contract, state model, signing, replay, and failure modes — the surfaces an engineering-review call will actually pull up.
The canonical runtime does not depend on human approval.
POST /v1/agent-events with a JSON body: action_type, tenant_id, actor_id, target_id, payload, correlation_id. Response is a canonical GatewayVerdict: verdict, reasons[], policy_content_hash, case_id.
Schema: src/governance/pivot/agent_event_schema.py. Rejects 18 known PII field-name aliases at the top of the payload AND one dict level deeper; payload string values are scanned for SSN, PAN, and RFC-5322 email patterns. Free-form commitment text is accepted and hashed into the tamper-evident chain and is NEVER echoed in HTTP responses, audit-log metadata, or telemetry.
Rule evaluation is pure: same AgentEvent + same policy_content_hash → same verdict, same reasons, same aggregate-state delta. No wall-clock reads inside the evaluator; time is injected. No network I/O inside the evaluator.
Invariants (DETERMINISTIC, FAIL-CLOSED, ESCALATE-ONLY, PRIVACY-FIRST, OFFLINE-FIRST, TAMPER-EVIDENT) are anti-drift tested — modifying evaluator I/O breaks the invariant guard suite before it reaches production.
Case lifecycle: PROPOSED → EVALUATED → (ESCALATED → APPROVED | BLOCKED) → EXECUTED → SEALED. Aggregate state (per-tenant exposure ledger) is versioned; every transition writes a delta to the case.
Backend: SQLite for pilot (single-writer, WAL). Postgres upgrade path is behind a deployment_guard profile check — enterprise + SQLite + multi-worker deployments raise at boot (fail-closed).
Per-tenant key isolation, cross-tenant PK prefix + row guard, disclosure-boundary sanitizer whitelists (12 total). CSRF on state-changing routes; rate limiting on portal proxy; HSTS + security headers on public surface.
Zero PII in HTTP responses, audit-log metadata, or telemetry; ephemeral event-store retention is opaque to external observers and expires within the tenant retention window.
Each Evidence Case computes a canonical content hash over the AgentEvent + policy_content_hash + per-rule records + aggregate-state delta. The hash chains into the prior case's seal, producing a tamper-evident receipt chain per tenant.
HMAC signing attaches when the operator configures GLZ_PIVOT_V1_HMAC_KEY. Signatures are per-tenant scoped; key rotation writes a versioned envelope so old packets remain verifiable.
A reviewer re-runs the sealed packet against the same policy_content_hash and recovers the exact verdict + reasons. Divergence is a bug and is caught by the replay-harness fixtures shipped with the SDK.
ReplayMetrics reports valid / invalid case counts per pack version; policy-pack upgrades run the historical corpus and flag any verdict deltas before rollout.
Supported failures are automatically contained, repaired, rolled back, or safely terminated.
GATEWAY_UNAVAILABLE error, never a silent GREEN.| Category | Example | Overlap | GreenLightz-unique surface |
|---|---|---|---|
| Cloud agent runtime | AWS AgentCore | agent identity, I/O filter | escalate class, cumulative exposure, per-case chain, action families |
| Agent-governance SaaS | Drata Agent Gov | evidence trail, escalation | deterministic replay, canonical hash input, per-action packet |
| Vertical agent | Intercom Fin | customer-written Procedure | vendor-neutral + cross-agent cumulative exposure + independent packet |
| Content guardrails | NeMo Guardrails | I/O content filter | consequential-action verdict + chain-hash receipt |
| Observability | LangSmith / Arize Phoenix | tracing | enforcement + evidence chain (complementary, not overlap) |
Source: docs/pivot/MARKET_REVALIDATION_503.md §3 (retrieved 2026-07-12).
GreenLightz ships with 9 built-in AI-agent action types. Each evaluation returns a policy-linked verdict and opens a reviewer-ready evidence case.
Full or partial monetary return. Evaluated against per-agent limits and aggregate thresholds.
Percentage or fixed-amount reduction. Policy-checked for stacking and cumulative exposure.
Shipping and delivery date commitments. Velocity-limited and deadline-bounded per policy.
Extension of subscription periods. Duration caps and cumulative exposure tracking.
Service level agreements on uptime, response time, or resolution targets. Duration and scope governed.
Data retention and processing commitments. Retention period ceilings and compliance-bounded.
Response time commitments for support tickets. Floor-bounded to prevent impossible promises.
Override grants and policy exceptions. Scope-limited with mandatory justification tracking.
Replacement, credit, or gesture of goodwill. Value-capped and precedent-tracked.
These aren't features you toggle on. They're architectural properties baked into every code path.
Designed for fully autonomous governed operations.
Invariants are engineering properties enforced by test suites and release gates — not commercial or legal guarantees, not third-party certifications, and not insurance.
Any error, timeout, or ambiguity results in BLOCK — never silent pass-through. The default state is denial.
Verdicts only move toward stricter enforcement. A green can become amber or red mid-evaluation, never the reverse.
Identical inputs produce identical verdicts across every run. No sampling, no temperature, no stochastic paths.
The core evaluation engine has zero external dependencies. LLM enrichment is optional and non-blocking.
Every identifier is HMAC-hashed with per-tenant keys before storage. Zero PII in HTTP responses, audit-log metadata, or telemetry; ephemeral event-store retention is opaque to external observers and expires within tenant retention window.
Every verdict produces an evidence packet with a deterministic content hash chain; HMAC signing attaches when the operator configures a signing key. Mutations are cryptographically detectable.
Trust boundaries
Stated once, clearly, in the language a buyer's security team will read. If a limitation applies, it's here — not scattered across footnotes.
The Evidence Case + reviewer packet is a runtime engineering artifact designed for internal governance and vendor-supplied risk evidence. It is NOT a legal-grade or regulator-ready audit artifact. Gate 10.5 (regulator-grade audit) is L0 and tracked as an engineering-closable item.
GreenLightz has not undergone an external security or compliance audit (SOC 2, ISO 27001, etc.). Deployers should treat the six invariants as design intent supported by anti-drift tests, not as third-party attestations.
Pilot deployments run on SQLite (single-writer, WAL). Enterprise deployments requiring multi-worker Postgres are blocked at boot by the deployment_guard profile check — this is a fail-closed intentional gate, not a scaling limit reached silently.
Evidence Cases are visible to operators through the portal today. A downloadable customer-facing export is a scoped roadmap item; the API returns a portal deep-link plus the case_id + policy_content_hash needed to reconstruct the packet offline.
AgentEvent ingest rejects 18 known PII field-name aliases across 11 families at the payload top level AND one dict level deeper. Payload string values are additionally scanned for SSN, 16-digit PAN, and RFC-5322 email patterns. Nested dicts beyond one level, base64-encoded PII, and free-form natural-language commitments are accepted — the SDK guidance requires callers to post opaque identifiers upstream of ingest.
GreenLightz is pre-first-customer. Numbers on this page describe engine capability and test coverage, not deployed-customer outcomes. Any customer-outcome claim on this site is dated to the pilot that produced it, or absent.
Key governance and claim-boundary properties are covered by automated test suites and release gates. During technical review, we show the exact checks that apply to the deployed scope.
These are internal engineering properties covered by our own test suites and release gates. They are not third-party certifications, not legal attestations, not audit opinions, and not insurance.
Founder, Atlas LLC · Delaware
“AI agents are taking customer-facing actions — refunds, SLAs, delivery dates — and nobody can answer the basic reconstruction questions about any of them after the fact. In software engineering, every deployment has evidence: tests, CI gates, signed artifacts. I built GreenLightz so each AI-agent action opens an evidence case: cumulative exposure by actor, target, and case, a policy-linked autonomous verdict against the signed pack (with approval lineage and the reviewer's note when a customer has opted into the optional human-in-the-loop workflow), and a packet a customer's reviewer can replay themselves.”[email protected]
See how GreenLightz turns each action into a policy-linked autonomous verdict (with an approval lineage entry if you enable the optional human-in-the-loop workflow), and a reviewer-ready packet. 30-minute demo.