Every agent action: policy-checked, ledgered, and human-approvable.
Praxis sits between AI agents and the systems they act on. It resolves every agent from a registry, runs a deterministic policy engine that fails closed on money, risk class, personal data and flagged guardrails, writes each decision to a hash-chained ledger, and puts anything risky in front of a named approver.
The problem
Agents now move money, answer patients and publish content. For any single action, most enterprises still cannot say which rule allowed it, who approved it, or prove the record was not changed afterwards.
What Praxis does
One decision point for every agent action. The agent is resolved from a registry, 16 deterministic rules route the action to auto, review or escalate, and the decision is hash-chained into a ledger before anything executes.
What you get
Autonomy you can grant agent by agent and defend to a regulator. Low-risk work clears on its own, risky work lands with a named approver, and every step can be reconstructed.
How a decision is made
The model reads the case and drafts the answer. It never picks the route. The route comes from code, from facts the model cannot change.
Five planes, one operating model
From a single agent to the whole estate. Open a plane to see what it owns and the metric that says whether it is holding.
The autonomy ladder, with the numbers the engine enforces
An agent climbs only as far as its evidence allows. L4 has no human on the loop, so it carries the smallest money ceiling of the acting tiers.
Every acting tier also needs the drafted answer to pass a 30% grounding check. A cap written into an agent's own spec (for example “auto-refund capped at ₹5,000”) can only lower its tier cap.
Governance controls: what is built and what is designed
8 controls an enterprise agent platform needs. 6 of them run in this reference implementation today.
Roles & Permissions
Each agent's tier, tools and owner are resolved from a server-side registry. A request can name an agent; it cannot describe one.
Approval Gates
A held run lands in an approval queue. A decision needs a written reason and is chained into the ledger.
Policy Engine
16 deterministic rules. The rules that fired are shown on the run and recorded with it.
PII Redaction & Data Boundaries
Card, Aadhaar, PAN, phone and email are masked before the model call, the retrieval query and the ledger.
Blast-Radius Limits
A money cap per tier, tightened by any cap written into the agent's own spec. Tools refuse to exceed the amount on record.
Kill-Switch & Rollback
Pause per agent, department or fleet with transactional rollback. Not part of this reference implementation.
Audit Trail
Every run, decision and sandboxed effect is hash-chained in the database and can be re-verified.
Change Management
Versioned promotion of prompts, tools and policies through staged environments.
What every agent spec declares
Nine parts, recorded for every agent in the registry. Pick one.
The planner/executor loop: how the agent decomposes a goal, selects steps, and decides when it is done or stuck.
Why it matters: Reasoning quality sets the ceiling on everything else; without explicit planning and stop conditions, agents loop, over-act, or quit early.
Borrowed from disciplines that already work, packaged as controls
SRE error budgets, circuit breakers, canary releases and trace standards, composed into one control plane. The edge is the packaging, not new science.
Each agent run is allotted a budget of unsupported claims; every assertion must cite a grounded source or spend from the budget, and when it's exhausted the agent must retrieve, hedge, or escalate instead of asserting.
A live monitor trips when an agent's groundedness or self-consistency drops below threshold across recent steps, halting the run and routing to fallback before a bad claim becomes a bad action.
Autonomy level is granted per blast radius, not per agent: the same agent runs L4 on low-reach actions and drops to L2 approval the moment an action exceeds its money, record-count, or segment ceiling.
New or upgraded agents run in parallel on live traffic, taking no real actions, while their proposed outputs are scored against the incumbent and ground truth until they clear a bar.
Movement up the autonomy ladder is a release gate: an agent advances only when its evidence ledger shows sustained eval scores, shadow-mode parity, and zero policy violations over a required window.
A handoff carries a scoped, signed, expiring token that proves the sender's authority to delegate and limits exactly what the receiver may do with the request and its data.
Always-on monitors compare live input distributions, tool outcomes, and eval scores against a frozen baseline, raising graded alerts and auto-demoting an agent's autonomy when the world shifts under it.
Every agent publishes a contract - target accuracy, latency, escalation rate, cost ceiling - and the Assurance plane meters it like an SRE error budget, throttling or pausing agents that burn their budget.
Market context
The market is building a control layer over every agent. Praxis is a working reference for its decision point.
Enterprise buyers are converging on a registry, identity, policy and audit layer that sits over every agent they run, whoever built it. The platforms below are building that layer. Praxis shows the part that has to be right first: the deterministic decision on each action, the evidence behind it, and the human who signs.
Microsoft Agent 365
A registry, access control and lifecycle management for the agents across an organisation.
Source: microsoft.comServiceNow AI Control Tower
Discover, govern and observe AI agents, with a deeper Microsoft integration announced in 2026.
Source: servicenow.comOpenAI Frontier
Launched in February 2026 with agent identity, scoped permissions, audit trails and evals.
Source: openai.comAmazon Bedrock AgentCore Policy
Policies written in Cedar and enforced at the tool-call gateway.
Source: aws.amazon.comWonderful
Raised a $550M Series C at a $5B valuation in September 2026, positioning itself as an AI operating system for the enterprise.
Source: wonderful.ai
Why now. Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027 (June 2025 forecast). Oversight is being written down: EU AI Act Article 14 requires human oversight of high-risk AI systems, and the AI omnibus in force since July 2026 sets 2 December 2027 for the high-risk obligations to apply (Art. 14, timing), and the RBI's FREE-AI committee report of August 2025 makes 26 advisory recommendations, including a board-approved AI policy and human oversight (summary).
Praxis is an independent reference implementation. It is not affiliated with, endorsed by, or connected to any company named here; each description is drawn from that company's own published material, linked above. Praxis does not integrate with these platforms.
Built in depth
The same control pattern, taken deep in three domains
- Arbiter
Credit decisioning: a governed fleet of agents where covenant and ratio gates are computed in code.
- ResolveIQ
Card-dispute resolution: disputes resolve inside a CRO-set policy; anything outside it stops with a written recommendation for an analyst.
- Azeon
Customer-service agents that take real actions behind policy gates, with an evidence ledger and outcome billing.
What is real here
Exactly what runs, and what is written for illustration
Runs on every request: a server-side registry of 198 agent specs; masking of card, Aadhaar, PAN, phone and email; amount, currency and intent parsing; BM25 retrieval over SOPs and specs; a 16-rule policy engine; a hash-chained ledger in Postgres with in-database verification; an approval queue; sandboxed tool execution with hard caps; a 20-case regression suite; and one live model draft per run, inside a site-wide daily budget.
Written for illustration: the agent specs, SOP passages, case records, design targets and cross-department flows.
Not built: connectors to real systems of record, the kill switch and rollback, change management, shadow mode and drift monitoring.