Lock out risky agent actions. Prove every decision.
Scan every agent write path, observe real calls in Shadow, then Gate the risky production actions behind a verified human decision. Every receipt is signed and verifiable offline.
Free posture scan · No credit card · Maps what your agents can reach
-
notion.pages.readAllowed
-
github.pulls.mergeReleased
-
stripe.refunds.createHeld
- Agent
- support-bot
- Action
- stripe.refunds.create
- Amount
- $4,800.00
- Policy
- Refunds over $500 need a human
- Requested
- 14:02:11 UTC
Try it: approve or deny the refund.
- Customer-held keysYour keys sign every record.
- Hash-chained ledgerTamper-evident. ECDSA P-256.
- Offline verifierCheck evidence without us.
- Verified approversOkta or Google sign-in.
- Signed Shadow reportsObserve without blocking.
- Hourly public anchorsMerkle root anyone can check.
- Deterministic policyPriority ordered, never model-decided.
- Signed receiptsEvery Shadow run and Gate decision.
- Compliance packsSOC 2, ISO 42001, NIST SP 800-171.
- Published latencyp50 8 ms, p95 25 ms for an automatic allow.
Logs tell you what your agents did. Interlok decides what they're allowed to do.
Agents now hold real keys: payment APIs, production databases, cloud permissions, customer data. Monitoring catches a mistake after it lands. Interlok puts a person in front of the few actions you can't take back.
Money
Refunds, payouts, transfers, and plan changes.
Production
Database writes, deploys, and infrastructure changes.
Data and access
Deletes, bulk exports, and permission changes.
Infrastructure
Deployments, cloud changes, and privileged automation.
One gate and one signed record, whatever you answer to.
The engine is the same everywhere. A compliance pack maps the signed record to the framework your customers, auditors or primes ask about.
Software and AI teams
Agents that act in production or in your customers' systems, and security reviews that ask what they did.
Defense suppliers
Agents, pipelines and admins near CUI, and an 800-171 affirmation that needs evidence behind it. Defense and CMMC →
Regulated industries
Finance, health and life sciences, where a named approver and an unalterable record are the rule.
Plants and infrastructure
Firmware changes, lockout events and grid systems, where a wrong change is physical.
Works with the agents you already build with: Copilot Studio, Agentforce, the OpenAI Agents SDK, Claude, Google ADK, Bedrock AgentCore, LangGraph, CrewAI, and the coding agents in GitHub Copilot and Cursor. They all reach tools over MCP, so one proxy holds the risky calls. See how each connects →
It gates actions, not agents.
Reads, searches, drafts, and routine work pass straight through. Only high-impact actions stop, so your team approves what matters instead of everything.
Reads, search, summaries, drafts
Flows straight through.
Routine writes: tickets, internal messages
Flows through and is signed into the ledger.
Payments, production writes, deletes, permission changes
Stops and waits for a human decision.
Actions no one should approve
Blocked by policy, and recorded.
- Held
- Released by a human
- Denied
- Allowed
Defaults work on day one, and every rule is code. Not sure where to draw the line? Start in shadow mode and see what would be held.
Find. Gate. Decide. Prove.
-
01
Find
Scan your agents' MCP servers, tools, and the credentials behind them. Every path to money, data, and production gets mapped, with ungated write paths flagged.
reach × capability × consequence -
02
Gate
Route tool calls through the Interlok proxy. Each call is checked against your policy in real time. Start in shadow mode, then enforce.
policy as code -
03
Decide
A held action waits for a person. Approve or deny in Slack or the console, with identity verified by your IdP.
an agent never approves an agent -
04
Prove
Every Shadow run and Gate decision is signed and hash-chained with keys you hold. Export a bundle mapped to SOC 2, ISO 42001 or NIST SP 800-171, and verify every signature offline.
signed receipt · offline verify
Exactly what Interlok is, and what it isn't.
Interlok is
- A stop-and-approve gate for high-risk agent actions
- A signed, verifiable record of every human decision
- A scan that maps what your agents can reach
- Policy you own and edit as code
- A layer that works alongside your existing gateway
Interlok is not
- A gate on every call. Routine work never waits.
- An agent builder or framework
- A prompt filter or content-safety tool
- An observability or evals dashboard
- An identity provider
Built for engineering teams whose agents can change production, and who have to prove control to someone else.
- Your agents call tools through MCP
- They can touch money, data, or production
- Customers, auditors, or a board ask for proof
- You run a plant, a line, or a fleet where a wrong change is physical
- You supply the DoD and hold CUI (see Defense)
- Agents built into SaaS tools you don't control
- Read-only chatbots
- Teams with no engineer to install a proxy
One proxy. One policy file.
Point your agents' tool calls at the Interlok proxy, commit a policy, and ship. Rules live in code and get reviewed in a pull request like the rest of your stack.
- Policy as code, with a versioned REST API and CLI
- Shadow mode shows what would be held before you enforce
- CI mode catches new ungated paths before merge
- Published gate overhead: p50 8 ms, p95 25 ms for an automatic allow
- Public CLI workflows for scanning, Shadow, and offline verification
$ interlok scan --ci
Scanned 4 MCP servers · 37 tools
Ungated write paths: 3
stripe.refunds.create money support-bot
postgres.execute production ops-agent
aws.iam.attach_policy permissions deploy-agent
34 tools read-only or low impact
exit 1 · gate or fix before merge# refunds over $500 wait for a human
- match: stripe.refunds.create
when: amount > 500
action: hold
- match: aws.iam.*
action: deny
# routine reads pass straight through
- match: "*.read"
action: allowScan free. Prove with Evidence Connect. Gate when you are ready.
Posture scanning and verification are free. Evidence Connect signs what your gateway already records. Production Gate starts at $499 and includes shadow mode.
Posture scan
FreeSee the paths your agents have to money, data, and production before you connect a gate.
- MCP server and tool discovery
- Ungated-write-path detection
- Deterministic risk score and shareable report
- Offline verifier for any Interlok bundle
Evidence Connect
Keep your gatewaySigned, graded evidence from the gateway you already run, ready for an auditor or an assessor.
- PolicyLayer, Runlayer or any gateway
- Evidence Room and Proof Export with auditor links
- Bundles mapped to SOC 2, ISO 42001 or NIST SP 800-171
Gate
Production enforcementHold high-risk production actions for a verified human and keep signed evidence.
- Everything in Evidence Connect
- Inline gate, policy as code, shadow mode to start
- Slack or console approvals with IdP-verified identity
- SOC 2, ISO 42001 and CMMC / 800-171 packs
- Signed Evidence Room with offline verification
The questions engineers ask first.
Will Interlok slow my agents down?
Routine calls pass straight through. For an automatically allowed verdict, measured gate overhead is p50 8 ms and p95 25 ms, shown on your overview next to the contract it has to meet. Held actions wait for a human and are not part of that figure.
Which agent platforms does it work with?
Anything that calls tools over MCP, which today means Copilot Studio, Agentforce, the OpenAI Agents SDK, Claude, Google ADK, Bedrock AgentCore, LangGraph, CrewAI, and the coding agents in GitHub Copilot and Cursor. Local agents launch your MCP server through interlok proxy; cloud builders register the proxy's HTTPS URL; your own code calls the gate API. Setup for each platform.
Does it gate every agent?
No. It gates actions, not agents. An agent that only reads, searches, or drafts runs exactly as it does today. If an agent can't do harm, you don't need to route it at all.
How does it know what's risky?
Every tool is scored on reach, capability, and consequence, using the real scope of its credentials rather than the tool's own description. You confirm the map before anything is enforced.
Do we have to replace our MCP gateway?
No. Interlok works alongside it. Your gateway routes traffic. Interlok adds the stop and the proof.
Who holds the signing keys?
You do. Every decision is signed with your keys and hash-chained, and you can verify evidence offline without calling us.
What happens if Interlok is unreachable?
Each connection decides. The default is fail closed: the tool call fails rather than running ungoverned. You can set a connection to fail open instead, and the calls it let through are ledgered retroactively.
Do you support CMMC and NIST SP 800-171?
Yes, for defense suppliers. The CMMC pack maps the signed record to all 110 NIST SP 800-171 requirements and names the ones that live in your own program. See defense and CMMC.
Can we delete data?
Derived data, yes — you set the window, with a floor set by the compliance packs you've turned on. Decisions, holds, determinations and anchors are kept for the life of the organization, because a chain with a hole in it proves nothing.
See what your agents can reach.
Run the free scan and get a map of your agents, tools, and business processes, with ungated write paths flagged.
Free · No credit card