Intercept
Connected tool calls pass through Cairn before they reach the tool. The agent sees an ordinary MCP endpoint. Cairn sees the action, its arguments and the identity of the agent that asked.
A control layer for AI agents
Control what
Control what
your AI agents
can do.
Put policy, human approval and a tamper-evident record between your agents and the actions that matter.
Working prototype · Pilot conversations open
Cairn Ledger · demo sample data
head d02b6f19
seqagentactionverdicthash
- 18204ops-agent-07payments.transferholdd02b6f19
- 18203ops-agent-07docs.searchallow7be04c1a
- 18202ops-agent-07crm.readallow4a91c7e2
- 18201research-03mail.senddeny9c12e8b7
- 18200research-03docs.searchallowe37f10aa
- 18199ops-agent-02crm.updateallow51ab8d03
- 18198ops-agent-02crm.exporthold310764e6
- 18197ops-agent-02crm.readallow149402c0
- 18196support-11kb.fetchallow08e87353
Illustrative actions. No live customer data.
01 Policy before action
02 People at the decision point
03 Evidence after every verdict
Agents act faster than anyone can watch.
An agent that can call tools can move money, change records and send messages thousands of times an hour. When an agent controls its own record, that record alone is not enough to establish what happened.
Cairn makes the record independent of the agent that produced it.
- 01
One control point
Connected tool calls pass through Cairn before they reach the tool.
- 02
Policy beside the verdict
Decisions record the policy identity and the rule that fired.
- 03
One chain
Each entry links to the one before it, so verification can detect changes to the retained chain.
One action, three mechanisms.
Follow a single tool call from the agent to the record.
Decide
A policy engine evaluates the call against versioned rules. Low-risk actions pass. High-risk actions are held for a named human, or denied. The verdict is one of three words: allow, hold, deny.
Record
The verdict is written to a hash-chained ledger with the policy version that produced it. Each entry includes the hash of the one before. Remove or reorder an entry and the chain breaks where it happened.
transfer-high-value returns hold.
03 · recordEntry 18204 seals 18203.
Console
Follow a decision from request to record.
Explore an interactive preview of the ledger, policies, approvals and test scenarios.
| seq | ts | agent | action | policy | verdict | hash |
|---|---|---|---|---|---|---|
| 18204 | 07:41:12Z | ops-agent-07 | payments.transfer | pay-core v3.2 | hold | d02b6f19 |
| 18203 | 07:41:09Z | ops-agent-07 | docs.search | pay-core v3.2 | allow | 7be04c1a |
| 18202 | 07:41:07Z | ops-agent-07 | crm.read | pay-core v3.2 | allow | 4a91c7e2 |
| 18201 | 07:40:58Z | research-03 | mail.send | comms v1.4 | deny | 9c12e8b7 |
| 18200 | 07:40:51Z | research-03 | docs.search | comms v1.4 | allow | e37f10aa |
| 18199 | 07:40:44Z | ops-agent-02 | crm.update | pay-core v3.2 | allow | 51ab8d03 |
Every entry, in order, with its hash and the hash it seals.
policy pay-core v3.2 active · published 2026-08-30 · 14 rules
rule transfer-high-value:
match payments.transfer
when amount > 10000 GBP
verdict hold
approver role:treasury
timeout 15m -> deny
rule transfer-sanctioned:
match payments.transfer
when counterparty in list:sanctions
verdict denyRules as code, versioned. The version is pinned in every entry it produced.
| held at | entry | agent | action | policy | status | Decision |
|---|---|---|---|---|---|---|
| 07:41:12Z | 18204 | ops-agent-07 | payments.transfer · 24,500 GBP · Northwind Ltd | transfer-high-value | hold | |
| 07:40:40Z | 18198 | ops-agent-02 | crm.export · 1,204 records · to object storage | export-bulk | hold | |
| 07:22:05Z | 18190 | research-03 | mail.send · external · 3 recipients | comms-external | allow · a.khan 07:24Z |
Held actions wait for a named person. The decision, the person and the time go on the record.
| scenario | attempts | held | denied | result |
|---|---|---|---|---|
| INJECT-DOC-01 | 12 | 3 | 9 | No unapproved action reached a tool |
| TOOL-HOSTILE-03 | 8 | 2 | 6 | No unapproved action reached a tool |
| EXFIL-APPROVED-02 | 15 | 15 | 0 | All exports held for approval |
| ESCALATE-SLOW-05 | 40 | 6 | 1 | 33 low-risk actions allowed by rule |
Adversarial scenarios run against the agent behind Cairn. The score is read from the ledger, not from a questionnaire.
Built for the people who have to sign.
A control point that does not depend on the agent vendor
Cairn sits outside the agent. It evaluates connected tool calls outside the model, giving your team a distinct place to define policy and inspect evidence.
Evidence that can be checked without trusting the operator
The prototype ledger and verifier use an open format. An exported record can be checked independently of the product interface.
A record built for the examiner
Replay any decision with the inputs, the policy version and the person who approved it. The record is written at the moment of the action, not reconstructed after the question.
Open core
Evidence you can take with you.
The prototype includes an Apache-licensed ledger and verifier. We are building the managed product around the same record, so evidence remains readable outside Cairn.
Cairn supports MCP tool interception. Each pilot starts with an agreed workflow, tool boundary and deployment configuration.
The current reference workflow uses synthetic payments scenarios. Pilot scope and deployment controls are agreed before customer use.
Read the assurance page$ cairn verify ledger.jsonl reading 18,204 entries chain intact · 0 gaps · 0 reorders anchor 2026-09-05T07:00:00Z matches policy versions referenced: v3.1, v3.2 ok
Evidence, not assurances
See Cairn hold an action and put it on the record.
A briefing takes forty minutes. We show the control point, the ledger and a replay, on your scenario if you send one.