The problem isn't that it fails. It's that it succeeds.
Software that acts on your behalf will carry out the job you gave it, including the part you did not mean to authorise, and afterwards the only account of what it did is a log kept by whoever ran it. This recording proves the fix: policy stopping the action before it happens, not a log explaining it afterwards.
What you are about to watch
No code on this page until you ask for it. Software that acts on your behalf will carry out the job you gave it, including the parts you did not mean to authorise, and afterwards, the only account of what it did is a log kept by whoever ran it. This page shows one being stopped, then tells you what that costs.
An agent is told to move money. It doesn't.
You ask the agent for something ordinary, read a public document. It reads it. Nothing interesting happens, and that matters: a system that refuses everything is not a control, it is an outage.
You ask the same agent to execute a payment. Before it can act, something else has already answered on your behalf, and the answer is no.
You are not told "something went wrong". You are told which rule said no, by name, a rule called deny‑payment‑execution, written down in advance by a person, not inferred after the fact from a log. The permitted case names its rule too: allow‑public‑document‑read.
This is the difference between a warning and a control. The refusal was not a note filed somewhere for someone to read on Monday. The agent stopped. The payment did not happen.
Those two rule names are the real ones the live demo returns for this exact request, verified against production and checkable yourself in a live walkthrough. The recording above this section shows a different request, reading customer data rather than moving money, refused by policy with no rule name visible on screen for that one. Ask for a live walkthrough and click "execute" on the payment option yourself, and check this description against the verdict you get, if they do not match, this page is wrong and you should believe the machine.
Now watch it happen
The agent is woken for a walkthrough, not left running.
The panel below drives a governed agent through the production policy engine, and that agent is torn down between walkthroughs rather than kept up. When it is asleep the panel says so and offers to book a walkthrough, and it never reports that as a refusal. The recording underneath is the same path, captured while the stack was awake.
Every option below is evaluated for real, by the production policy engine, against a governed agent. You are not choosing a canned answer: the verdict comes back from the same path a provisioned agent takes.
Loading what the demo can evaluate…
The live demo runs on request. The governed agent behind it is woken for a walkthrough rather than left running, so there is nothing to drive here at the moment. Everything else on this page is unchanged, and nothing about the demo is gated: this is our side, not yours.
Book a walkthroughNo account, no key, and nothing installed. Solara signs this request as the shared demo agent, because you hold no credential and were issued none, a dedicated agent with an identity of its own is what the paid tier is.
Why this is your problem
The question always arrives afterwards.
"Who authorised that?"
Asked by an auditor, a customer, or a regulator, months later. The usual answer is a log file kept by the same team whose system is in question. Here, the answer is a signed proof that travels with the action itself and can be checked by someone who trusts neither of you.
"It was allowed to do what?"
Agents get given broad permissions because narrowing them is fiddly and nobody has time. The narrowing is what this is: an agent carries exactly the authority it was granted, and the credential expires and renews itself rather than sitting valid forever.
"Whose agent was it, though?"
The interesting failures happen between organisations, your supplier's software acting on your behalf, or yours on a customer's. There is no shared login between you. A signature works anyway; a shared login cannot exist.
Before the price
What this is not, said before you ask what it costs.
This is the section a sales page leaves out. If you are here because AI feels urgent and unmanaged, the risk is buying something adjacent to the thing you needed, so here is the boundary first.
An agent that does your work. We do not build the agent, we do not write what it does, and we hold no model key, you supply your own. What you get is the identity, the authority and the record around an agent you or your team build.
Something you can buy today. Two separate reasons, and both would each be enough on its own: there is no bank account or payment processor in place yet to take the money, and provisioning is granted deliberately rather than bought, so an account starts with no authority to spend.
Compatible with every AI framework. Two exist as governed templates today: Google's ADK and OpenAI's. If your team built on something else, that is a conversation, not a checkbox.
A way to make agents talk to each other over industry protocols. Those protocols are documented and most have no working connection behind them. Do not buy this for that.
Instant. Provisioning one agent took 217 seconds when it was measured, and the system gives up at 420. It is a deliberate, slow, recorded act, which is rather the point, but it is not a button that resolves while you watch.
The ending
£199 a month, and here is the whole of it.
Nothing above is payable today, there is no bank account or payment-processor verification in place yet (see the price page). That is the reason to talk now rather than wait: what's demonstrable today is the governed agent itself, a request proven, allowed or refused, against the production policy engine (see the recording), and the open primitive underneath it you can install and verify yourself in about twenty lines, no account needed (the quickstart).
A pilot means a provisioned agent of your own, with its own identity, policy enforced on every call, and a credential that expires and renews, the same scope described under "What is and is not included" above and on the price page. It runs against the same Google ADK or OpenAI Agents templates that are proven today; anything else is a conversation, not a checkbox.
We are looking for our first design partners: teams running, or about to run, agents that act across systems or teams. Scope, duration and terms are agreed individually. Tell us about your use case and we'll propose an evaluation, and be clear about what can be demonstrated today.
Creating an account is open and takes a moment. Being allowed to provision an agent is not self-serve and is granted deliberately. The page below carries every number here with the working behind it, including how long a provision takes and where that measurement came from.
Discuss a design-partner pilot.
Tell us what your business is doing with AI today and where it's starting to need identity, permissions or an audit trail. We'll say whether a pilot fits and what it would involve.
Wrong door?
I build with agents and I want the identity primitive.
Builders about 90 seconds 02I am responsible for securing agents my organisation runs.
Security leaders about 6 minutes 03I want this operated for us, on our terms.
Enterprise about 3 minutes 04None of those, or not sure yet.
Everyone else about 2 minutes