Investigations for security and platform teams

Invite-only pilot. Public signup is closed. Request an invitation or sign in to your existing account. The sample investigation remains open to everyone.

Investigate AI actions. Keep the unknowns visible.

Connect agent requests, policy decisions and reported outcomes in one investigation. Reach a supported conclusion and share tamper-evident, independently verifiable exports. Add supported hooks when you also need runtime controls.

Try a sample investigation Control my agent Investigate existing activity For developers and teams

See an allowed action, a blocked action and a missing receipt. Download the synthetic report and verify its evidence without an account. Connecting your own agent requires setup and a workspace.

Claude Code session sess-4c1e9a
  1. ReadREADME.md
    Allowed
    Receipt missing; outcome unknown3f9a0c…e21d
  2. Editsrc/billing/invoice.py
    Needs approval
    Held for a reviewer8c21d4…07b3
  3. Bashrm -rf ./build
    Blocked
    Recursive forced deleted40e9f…5a18
Hash chain linked head 9b14…07fa
Synthetic example of connected activity, not a claim of complete session capture.

Hooks and application-owned dispatch adapters

  • claude-code
  • openai
  • anthropic
  • gemini
  • ollama
  • mcp
  • langgraph
  • crewai
  • autogen
  • custom

Every check ends in one of three decisions.

For connected hosted checks, choose which tools run, wait for review, or are denied. The hosted coding-policy checks remain active; a generic local policy engine is not a shell sandbox.

Allow

Valid actions continue, subject to the agent's own permissions.

Read README.md

Require approval

The exact action waits for a reviewer. An approval permits one matching retry.

Edit src/billing/invoice.py

Block

The hosted coding-policy path denies this recognized destructive command even under an Allow rule. This is not a guarantee for every local policy, shell command, or unwrapped tool.

Bash rm -rf ./build

How it works

Investigate first. Add control where it matters.

A review step for actions that matter, alongside a timeline you can inspect afterwards. Read existing records without enabling a new enforcement integration.

Read the product walkthrough
  1. connect

    Keep the assistant you use.

    Guided setup for Claude Code, or a downloaded adapter for application-owned tool dispatch. Framework labels do not mean automatic interception or a turnkey plugin. The closed-source client ZIP is available through authenticated onboarding for the direct EnforcementClient SDK and read-only Forensics MCP. It is separate from the native-connector adapters below; do not install a public namesake package.

    Sign in to install the native connector and download the adapters. Extract pramagent_gate.py beside your application; this Python adapter uses the standard library and the installed connector, not a pip-installed SDK.

    from pramagent_gate import Gate

# send_email and tool_call belong to your application.
gate = Gate({"send_email": send_email}, integration="openai")
# Runs the tool only after an explicit allow.
result = gate.tool_call(tool_call)
  2. control

    Make the boundaries explicit.

    Set Allow, Require approval, or Block for each exact tool, or import a validated JSON rules template. Claude Code can confirm in its own prompt; other adapters use website review. Slack, Teams, or Telegram can notify your reviewers. Notifications do not automatically resume an agent.

    Read claude-code
    Allow
    Edit claude-code
    Require approval
    delete_customer_record openai
    Block
  3. investigate

    Follow the evidence, including its gaps.

    Search a session timeline, replay the recorded policy, and export a signed bundle you can verify offline. Missing receipts and unavailable checks stay visible.

    The exported ZIP includes verify_bundle.py (the standalone bundle verifier), not a script you must invent. Use a verifier from a trusted release, or authenticate the supplied script independently before running it. Extract it into a new directory and keep evidence.zip available there. Obtain exporter and collection public keys independently.

    $ python -m pip install cryptography pqcrypto
$ python verify_bundle.py evidence.zip --trusted-key exporter.pem --v2-keys checkpoint-keys.json
# Exit 0 authenticates the selected records.
# It does not prove a complete history.

    V2 checkpoint verification needs the collection key registry. Without authenticated record contents, verification remains unattested. pramagent evidence-v2-verify checks a V2 envelope; it is not a ZIP bundle verifier.

Review the exact action, not a summary.

Website review shows the proposed tool and arguments, bound to the session that asked. An approval permits one matching retry within 15 minutes.

The Pramagent approvals page showing a pending Edit request with its exact arguments, approve and deny controls, and two earlier requests. The Pramagent approvals page in dark mode showing a pending Edit request with its exact arguments and review controls.
Agent approvals in the Pramagent console, shown with example data.

Useful for your session. Accountable across your team.

For developers: understand a session

Start with the no-login sample. In your workspace, inspect recorded tool decisions, blocks and supported outcome receipts. Keep your agent's existing permissions; the timeline shows what was submitted, not everything that happened on your machine.

Explore the developer example

owner

For teams: investigate and review

Use workspace roles, shared exact-tool rules and separate reviewers. Follow selected evidence through cases, missing outcomes and offline-verifiable exports. Agree on capture scope, retention, access and recovery expectations before a sensitive-data pilot.

Discuss a team pilot · Review trust boundaries

owneradmindeveloperapproverinvestigatorviewer

Integrity is part of the story. It isn’t the whole story.

Pramagent records decision metadata and audit hashes. Website reviews also retain encrypted proposed arguments. Other workflows can retain additional content.

Hashes cannot reconstruct missing information or prove an action executed. Investigation exports make those limits explicit.

Workspace owners can choose metadata-only, customer-retained inputs, or operator-enrolled encrypted snapshots. The effective capture policy is visible in Evidence settings. Changing modes does not recover old arguments or delete earlier evidence; no automatic retention deadline is promised.

Read the data and security boundaries
  1. Check recorded3f9a0c…e21d

    Tool, decision, and policy revision.

  2. Approval recordedapr-77d0c1

    Reviewer and exact action fingerprint.

  3. Execution receiptnot recorded

    A check is not proof that the tool ran.

  4. Export signedevidence.zip

    Selected records, with the gap stated.

Long-lived evidence, explicit trust

Post-quantum signatures. Not quantum-powered analysis.

Hybrid collection checkpoints

Configured evidence-v2 checkpoints use Ed25519 + ML-DSA-65 signatures. That is separate from the bundle manifest's Ed25519 signature. Verify the actual algorithms and separately trusted keys; not every deployment or historical record has a hybrid checkpoint.

Verification beyond this service

Selected evidence can be checked offline. Archive renewal tools are available for operator-managed preservation; renewal is not automatically scheduled and no decades-long retention or future-proof guarantee is made.

Signatures have a defined job

They authenticate signed bytes under trusted keys. They do not prove complete collection, independently observed execution, legal admissibility or compliance certification.

Hardware research stays separate

Ordinary investigation and tool checks do not depend on a quantum computer. Quantum hardware experiments are a separate research track, not a demonstrated detection advantage. Explore Labs and research boundaries.

Light by design. Deterministic checks, explicit limits.

The deterministic enforcement path evaluates rules without an additional model call. Hosting, storage, and optional model-based features still use resources. We do not claim measured carbon savings.

No model call per check

Deterministic tool checks, approval matching, and evidence hashing use ordinary CPU code. Optional model-based reviews are separate and can consume tokens.

Latency depends on your deployment

Rule evaluation, audit storage, and network round trips all contribute to latency. Local benchmarks are not a production response-time guarantee.

Explicit stop signals

Connected adapters return denials and pending approvals to the host. Your agent must honor the stop signal; a rate limit alone cannot prevent it from making more model calls.

Start with bounded evidence

Choose capture deliberately. Metadata, encrypted snapshots, exports and backups have different storage costs and recovery requirements. A limit is not a retention or availability guarantee.

Before you connect

Where do approvals happen?

New Claude setups use native confirmation by default, subject to workspace rules. Other adapters use the website. External channels send a link to authenticated review. Resume the agent after website approval.

What can I install?

Native preview connectors support Windows, macOS, and Linux, with integration-specific setup instructions. Publisher signing and macOS notarization remain pending.

Can an agent bypass the hook?

A hook is not an operating-system sandbox. Actions outside the configured tool path and changes made by someone with local control may bypass it. Organizations need managed runtime settings and endpoint permissions.

Does an approval prove the action ran?

No. A pre-tool decision records what was allowed or denied. Supported post-tool hooks add a host-reported outcome receipt with status, output digest, and attributed file changes; the investigation keeps missing receipts visible.

Start with one understandable session.

See an allowed action, a blocked action and a missing receipt before connecting anything.

Try the sample Request an invitation