Works with
LangChain
LangGraph
CrewAI
MCP
Claude
ChatGPT
Slack
The limits a risk team gives a new employee, applied to agents: how much per action and per day, counted across every agent and every person, who approves above the line. Enforced before the action. Every permit verifies offline.
LangChain
LangGraph
CrewAI
MCP
Claude
ChatGPT
Slack
The agent obeys.
The log records it.
The money is gone.
Ten refunds, each under the €500 limit. Every one passes on its own. Only a running total sees the eleventh.
A person approves every action. At agent volume they approve everything. One click is the only evidence anyone looked.
One wrong tool call is a real incident. A bad refund, proposal, or deploy is €74,200 and a customer call, not a failed unit test. The blast radius is production.
The risk owner signs a policy a person can read: limits, escalation ladders, the contract changes an agent may make, and who decides above the line. A change is a new signed version, never a quiet edit.
Before each action the agent asks for a permit for that exact payload, over MCP or one REST call. Inside the rules it acts alone, above them a named person decides, outside them nothing runs. A permit, not a standing API key.
Every permit and referral leaves a receipt that verifies offline, on your own machine, without trusting the model, the vendor or us. Every action checked as it happens, not a sample weeks later.
It remembers. State and counters live in the policy, so the daily total holds across every agent and every human.
It issues permits. Each action gets a permit for that action, now, from current state. Above a limit, a named person decides.
It cannot change quietly. Every policy is a signed version. A change is a new version with its own record, never a silent edit.
It stays readable. A risk officer can read it without an engineer, and the owner signs what it means.
Agents connect through MCP or one REST call. Decisions in about 100 ms. Stategram approves; your systems execute.
When someone asks who allowed the €74k refund, you hand them the receipt: what was tried, which rule fired, what evidence was checked, who approved. Signed at decision time, not reconstructed in hindsight.
It is also the screen you bring to the risk review. It tends to end the meeting.
Running agents already? Send a sanitized trace and get the memo back.
We can't quietly rewrite history. Neither can anyone else.
Everything above orchestrates or records. Stategram is the preventive control in front of them.
For teams that switch on their own agents.
For one agent stuck in read-only or human review.
For banks, insurers, regulators and agencies.
Not sure which fits? Talk to founder.
If we hold the controls for your AI agents, we have to hold ourselves to the same standard. Hosted by us on AWS in Frankfurt, or dedicated for an enterprise, encrypted in transit and at rest, with signed receipts that verify without trusting our servers.
Hosted by us in Frankfurt, Germany, or in your own AWS or Azure tenant. On the hosted release, policies, receipts and backups stay in the EU.
TLS 1.3 · encrypted disks
TLS 1.2 or 1.3 on every connection, and plain HTTP is redirected. Every disk is encrypted at rest, and so is every backup.
Standard processor DPA on request. Receipts are designed to support EU AI Act Article 12 record-keeping for high-risk AI systems.
Every permit carries a stack of signatures that traces back to the policy you signed. Check any permit yourself, offline, in about 10 ms, with nothing from us. A refusal comes back with the rule that fired.
The engine's building blocks have been audited by two external security firms in two countries. Read where your data is stored · how the trust loop works · [email protected] for disclosures.
Silver Sepp has spent twenty years on systems where a mistake costs money: the in-house trading platform of a global commodity trader (physical and paper) and, before that, Estonia's national court information system and its criminal case registry.
Since 2022 he has built Toolblox, money workflows drawn as state machines and compiled from building blocks audited by two external security firms. On it, 4,500 registered users have drawn 6,000 workflows: funds, repayment schemes, community programmes and more. He has authored hundreds of them himself.
Since 2024 he has been building agents with their own money and spending rules, before agent payments were an industry topic. Stategram is that work, built for companies whose agents touch money.
You could. Teams could also write their own identity provider, and almost none do. Identity tools verify who the actor is. Access tools decide which doors open. Nobody builds those in-house, because the value was never the code. It is being one layer outside the team it constrains. A limit your own service owns is a limit your own service can quietly raise. Ours cannot be raised by the people it applies to, and the receipt says so.
Those check one call, with no memory, inside your own stack. Stategram holds state across actions and actors, sits outside the team it constrains, and signs evidence an outsider can verify.
You can, and for one agent in one system it is often enough. The questions come later: who can change the number, who signed it, does the count include the other agents and the people in the back office, and what does audit get besides the builder's own log. A limit outside the systems it limits answers all four.
A decision engine returns a result. Stategram returns a permit the executing system has to hold, counts across every agent and person, and leaves a receipt an outsider can verify. Keep your decision engine and put the permit in front of the action.
Policy made mandatory. Proof by default. Live in two weeks.
We will email you to find a time for a 25-minute walkthrough with the founder. No slides, no sales script.
Pick a time in the founder's calendar, or tell us about your agent first.