Estoppl Demo Deployer
A demo deployer simulating support + treasury agents at a hypothetical consumer lending fintech.
Where you put a kill switch in front of an autonomous agent before it does something irreversible.
A runtime control plane in the agent's tool-call path — guardrails that reduce blast radius on irreversible actions, kill switch for runaways, human review for the ambiguous ones, and a tamper-evident record of every decision.
Live capture: a support agent attempts a Stripe charge through MCP. Policy routes the call to human review, the on-call human gets an email with one-click approve/deny, and the action holds until they click.
- •Policy guardrails on every tool call before it leaves your perimeter
- •Kill switch — remote policy update propagates to all proxies in ≤5s
- •HITL routing for irreversible actions; held until a human approves
- •Tamper-evident audit log — hash-chained, Ed25519-signed
Sub-millisecond hot path. Single Rust binary; deploys as sidecar, gateway, or stdio proxy in front of your existing tool servers. Configurable field redaction keeps secrets out of the audit log.
Irreversible agent actions this proxy intercepted before they executed. Without a control plane in the agent's path, each one would have happened — blast radius unbounded.
What the agent attempted (and what got stopped)
Each row is an action the agent attempted, the policy rule that fired, and what the proxy did about it. BLOCKED actions never executed (blast radius zero); HUMAN-REVIEW actions held at the policy boundary until an on-call human approved or denied.
| When | Agent | Tool | Decision | Rule |
|---|---|---|---|---|
| just now | treasury-agent-v2 | transfer_funds | Human review | money_movement |
| 2h ago | support-agent-v1 | issue_refund | Human review | amount_above_threshold |
| 10h ago | treasury-agent-v2 | transfer_funds | Human review | money_movement |
| 16h ago | support-agent-v1 | issue_refund | Blocked | amount_above_threshold |
Tool surface
Every tool this agent has called in the last 30 days and how each call was decided. Useful for scope review.
22 actions in the last 30 days — 18 auto-allowed, 3 routed to human review, 1 blocked at the policy boundary.
Three pillars
Each subscore is computed live from the event chain. See the formulas →
Governance discipline
Are high-risk actions being routed to humans at the right rate — neither rubber-stamped nor over-escalated?
- events total
- 22
- hitl rate
- 13.6%
▸Framework references
- NYDFS 23 NYCRR 500.13 (audit trail of cybersecurity events)
- FINRA 4511 (books and records)
- AIUC-1 §3 Accountability
- AARM v1.0 §2.3 (HITL governance)
Scope adherence
How often does the agent try things outside its approved scope of authority?
- block rate
- 4.5%
- blocked count
- 1
▸Framework references
- NYDFS 23 NYCRR 500.11 (third-party service provider security policy)
- FINRA 3110 (supervision of automated systems)
- AIUC-1 §2 Safety (scope-of-authority controls)
- AARM v1.0 §3.1 (policy enforcement at the agent boundary)
Anomaly load
Rate of unusual or out-of-pattern tool calls relative to this agent's baseline.
- events total
- 22
- unique agents
- 4
- unique tools
- 8
▸Framework references
- NYDFS 23 NYCRR 500.14 (monitoring and detection)
- AIUC-1 §5 Reliability (anomaly detection)
- AARM v1.0 §4 (runtime telemetry)
Verify this certificate yourself
Don't trust the page — verify the signature. The cert is signed with Estoppl's Ed25519 key, published at /.well-known/jwks.json. Click the button below to verify locally in your browser (no install, no Estoppl server in the loop), or download the signed JSON and use the CLI verifier offline:
estoppl verify-certificate cert.json
- Deployer ID
- 1c6a30f5-586b-4b67-96a1-a71728243f7e
- Certificate ID
- estoppl_cert_v1_1c6a30f5-586b-4b67-96a1-a71728243f7e_20260602215813
- Public Key ID
- estoppl_signing_2026q2_v1
- Issued
- Jun 2, 2026, 9:58 PM UTC
- Methodology
- v0.1.0
- AARM Version
- v1.0
- AARM Conformance
- aligned_extended_review_pending
- Signature
- Pl0OKG9HxQMySkqk…6nmJAg==
- Policy ID
- policy_v3_support_agent
- Max Action Value
- $5,000
- Policy Hash
- sha256:8f4a2b7c91e3d40fc4ee9e8d3b2c1a5e6f7012a3b4c5d6e7f8091a2b3c4d5e6f
- Policy URL
- https://api.estoppl.ai/v1/policy/sha256:8f4a2b7c91e3d40fc4ee9e8d3b2c1a5e6f7012a3b4c5d6e7f8091a2b3c4d5e6f
- Scope Summary
- Customer support · payments ≤ $5,000 · refunds ≤ $500 · no PII export
- Allowed Tool Namespaces (3)
- stripe.charges.* · stripe.refunds.create · internal.crm.read.*
- Denied Tool Namespaces (2)
- stripe.transfers.* · internal.crm.write.*
- Valid Until
- 2026-06-02T22:58:13Z
- Event Count
- 22
- Sequence Range
- 1–1
- First Event Hash
- b2c3ac1216cc0f471ee86f2f1133366cc845c2021b5be18e3fcdf2411d8ff5c4
- Last Event Hash
- b3ae66d505d2db953d1216adf4a617db62c3ebd24722658163404ad55071cd48
Want a runtime control plane in front of your agents?
Limited to a few fintech design partners this quarter. Founder-direct, kill-switch authority + guardrail rules tailored to your agents, ground-floor terms — no CSMs, no SDR funnels.
— Tina Ho, founder · ex-Netflix, ex-Amazon · LinkedIn ↗
Same certificate and evidence chain — three lenses on the same substrate.
Audit-ready evidence
→Framework-mapped audit trail for compliance + GRC. NYDFS, FINRA, AIUC-1.
Cross-company trust substrate
→Cryptographic primitives for the agentic commerce protocol — signed chains, JWKS verification, cross-boundary trust.