Most agents never leave the pilot, because nobody can say what they'll never do. Everyone else logs what your agent did — we certify what it won't. Not a wrapper with a stern system prompt: a research technique we developed that turns your written policy into a decision layer whose behavior can be exhaustively verified — your agent is tested against thousands of adversarial cases built from it, and you can re-run that certification yourself, seed for seed. In production, a forbidden action can't get through the guard — and every ruling ships with a receipt citing the exact rule that decided it. The technique is ours; every result is yours to re-run. One team's violation rate: 68% before, zero after.
Three steps, in the order your team will actually adopt them — each works with the agent you already have.
Point your coding agent at last month's logs — it extracts the facts of each decision, our engine grades them. Every decision comes back marked compliant or violation, with the exact policy line and the correct action. Your first compliance report, in minutes.
audit(logs) → 214 violations · citations · fixesOne call before each action. Legal ones pass. Illegal ones can't execute — your agent gets the citation and the right alternative to relay. Brain untouched; hands only bend in legal directions.
guard(action, case) → allow | deny + citationWhen you're done re-teaching rules your LLM keeps forgetting, the decision layer takes the wheel — certified by a battery of thousands of adversarial cases you can re-run any time.
create_agent(policy) → certified · receipts onNo SDK, no migration. Developers use it from their coding agent; production calls a plain HTTPS API; compliance gets a read-only receipts dashboard.
claude mcp add --transport http warranty \ https://api.canonopylabs.com/mcp \ --header "X-API-Key: $KEY"
POST /v1/guard
{ "action": "process_refund", "case": {…} }
→ { "allow": false,
"denied_because": ["your §4.2"],
"suggested_action": "verify_identity" }
This isn't a wrapper around a model with a stern system prompt. It comes out of a research program on making agent behavior provable — a technique we developed that turns a written policy into a decision layer whose behavior can be exhaustively verified, and that makes the agent itself trainable against that layer. The technique is ours; every result it produces is yours to re-run.
Most aren't — and the ones that are split cleanly into three tiers. We tested this: a reply-quality policy full of subjective words — empathy, tone, dismissiveness — became a fully certified domain (0 violations across 2,000 cases), and a 21KB model learned the entire rule set to 100% held-out accuracy from exported examples alone.
"Never blame the customer." "No unapproved promises." "Every reply needs a next step." These sound like judgment calls; written down, they're checkable rules. Most of what teams call subjective lives here — during onboarding it becomes part of your certified rule set, and training data for your own model.
"Show empathy when the customer is upset." Does acknowledgment count, or does it take an apology? Both readings are defensible — so the sign-off surfaces the split, the policy owner picks one, and from that moment it's tier 1: a certified rule with a citation. Ambiguity gets converted, not averaged.
How warm the wording feels, whether a joke lands — no rule decides that, so we don't pretend to. Your model keeps its voice; the guard underneath makes sure nothing it says can turn into a forbidden action or an unapproved commitment. Free on the surface, bounded at the decision.
The questions a serious buyer should ask — answered the way we'd answer an auditor.
The decision. Given the facts of a case, the ruling is deterministic: the same facts always produce the same allow/deny, the receipt names the policy line that decided it, and the certification battery re-runs identically for you or an auditor, seed for seed. Upstream of the decision, your agent extracts those facts from the conversation — that step is language, not law, so the facts the engine ruled on are printed on the receipt. If extraction got something wrong, the receipt shows it. That's the honest boundary: rulings are guaranteed; everything that fed them is auditable.
Because you approve decisions, not prose. At onboarding you sign off on dozens of concrete decided scenarios — case, ruling, citation — which is where ambiguities in a written policy surface before production, not after. (They exist in almost every policy: a public benchmark's own policy text yielded one.) You can add your own gold cases to the battery at any time. And the approach has been checked against an independent referee: on a public agent benchmark, our rulings were replayed through the benchmark's executable environment — 100% agreement — and the 8 disagreements with its hand-written answer key turned out to be errors in the answer key. Write-up available on request.
Three artifacts, none of which require trusting us. A certification you can re-run yourself — same seed, identical report, any time, including in front of an auditor. A receipt for every production decision, showing the facts the engine saw, the ruling, and the policy line that decided it — retained per your tier, so "what did it see at decision time?" has an answer months later. And an audit trail where denials are first-class records, not absences — you can show what the agent was stopped from doing, with the rule that stopped it. If EU AI Act obligations are on your desk: the logging and human-oversight evidence it asks for is what this system produces as a side effect of running.
Use them — for infrastructure authorization; they're good at it. Cedar and OPA are rule evaluators: you hand-write rules in their language, they answer allow/deny, and that's where they stop. This layer starts from your policy in plain English, handles the stateful business rules authorization languages express awkwardly — order lifecycles, booking windows, refund routes — returns receipts that cite your own wording, ships an adversarial certification battery you can re-run, and exports labeled training examples that make your own model better between audits. One is a permissions component; this is the compliance loop around your agent.
Free to find your violations. Thirty dollars to guard your first agent. The serious tiers arrive when the compliance questions do.
Built for teams with an agent stuck in review — or one they'd rather never review again. Free tier, no card. Your key works on both doors: the MCP endpoint your coding agent connects to, and the REST API your runtime calls.