Aarvion sits between your AI agents and your regulated systems. You decide what they're allowed to do. We enforce it on every call — and prove it to your business, your engineers, and your regulator.
Why this matters
Your AI agents are taking autonomous actions on your internal systems — based on input from external users you don't trust.
Today, the only thing standing between a prompt injection and a real-money transaction is the LLM's good behavior.
We make that deterministic. Every action the agent takes is authorized by your policy, in real time, before it touches your systems. The audit log proves what was allowed — and what was blocked.
The LLM can be jailbroken.
The gateway cannot.
AI agents are entering production faster than enterprises can govern them. The control layer has to exist before the incident — not after.
What Aarvion does
Before an agent approves a refund, changes a record, executes a workflow, or triggers a payment, Aarvion verifies the action is authorized by your policy, records cryptographic provenance, and writes an auditable decision trail.
Aarvion is a proxy — not a framework you rebuild around. It runs inside your own environment and the agents simply route through it.
The loop
Define what's allowed. Sharpen it on real traffic. Enforce it in real time. Prove it to anyone who asks. Then sharpen again.
The contract is authored.
Aarvion ingests your OpenAPI specs, runbooks, PR history, and operator interviews to draft a manifest. Engineers and compliance review it together. The output is a signed, versioned YAML in your own Git repository.
The contract sharpens.
Production traffic feeds back into the manifest. Decisions where Aarvion was too strict or too lenient surface for human review. The manifest commits new revisions every cycle — measurable, not vibes.
The contract is applied.
Every regulated call passes through the proxy. All seven primitives evaluated in-memory, sub-5 ms p99, no network hop. Pass, park for a human, or block — the decision is taken outside the agent's reach.
The contract is provable.
Every consequential action becomes a 2 KB hash-chained record. Externally witnessed. Bound to the manifest version, the human who approved, and the rule that fired. A 14-day audit becomes a 90-second query.
1agent: claims.refund.v22manifest: claims-refund3version: 174checks:5 scope: agent.refund6 idempotency: single-use, required7 cost_rate:8 amount_max: 750009 currency: USD10 reversibility:11 must_be: settlement_open12 on_fail: hold13 cascade:14 blast_max: 3 systems15 semantic:16 declared_effect: refund_only17 authority:18 inherit_from: actor.oauth19 must_be: narrow20signed_by: rohit.sadhu@aarvion · 4f1a9b
The contract is authored.
Aarvion ingests your OpenAPI specs, runbooks, PR history, and operator interviews to draft a manifest. Engineers and compliance review it together. The output is a signed, versioned YAML in your own Git repository.
1agent: claims.refund.v22manifest: claims-refund3version: 174checks:5 scope: agent.refund6 idempotency: single-use, required7 cost_rate:8 amount_max: 750009 currency: USD10 reversibility:11 must_be: settlement_open12 on_fail: hold13 cascade:14 blast_max: 3 systems15 semantic:16 declared_effect: refund_only17 authority:18 inherit_from: actor.oauth19 must_be: narrow20signed_by: rohit.sadhu@aarvion · 4f1a9b
The contract sharpens.
Production traffic feeds back into the manifest. Decisions where Aarvion was too strict or too lenient surface for human review. The manifest commits new revisions every cycle — measurable, not vibes.
The contract is applied.
Every regulated call passes through the proxy. All seven primitives evaluated in-memory, sub-5 ms p99, no network hop. Pass, park for a human, or block — the decision is taken outside the agent's reach.
The contract is provable.
Every consequential action becomes a 2 KB hash-chained record. Externally witnessed. Bound to the manifest version, the human who approved, and the rule that fired. A 14-day audit becomes a 90-second query.
04 refines back to 01
In action
A claims agent tries to refund a customer who's already past the settlement window. Scroll to watch the request flow through Aarvion — and what happens when it doesn't.See what happens with and without Aarvion in the middle.
Token is valid. Scope is allowed. The request goes straight through. Nothing in the path knows the rule the agent is about to break.
No precondition was ever checked. A 30-second reversal becomes a 30-day legal recovery. The agent doesn't even realize anything is wrong.
Marketing fires. The BI table drifts. Forty-one finance invoices lose their reference. The ledger debit/credit drifts $58K. Nobody notices for nine days.
Four log streams, no cryptographic link between them. Two engineers, fourteen days, one incomplete picture. The regulator stays skeptical.
The request is intercepted before it reaches any system of record. Identity, scope, agent, and session are bound to the call.
Scope, idempotency, cost, reversibility, cascade, semantic drift, authority. Six pass. One fails — reversibility, because the settlement window closed 2h 14m ago.
A human reviewer is routed in with the full context — including the recovery cost if they approve anyway. Their decision is signed against the rule it crossed.
A 2 KB, hash-chained, externally witnessed entry. Provable to your regulator in 90 seconds. Tamper any field — the chain breaks, mathematically.
{
"policy_id": "PL-887234",
"amount_usd": 58000,
"reason": "customer_request",
"idempotency_key": "f3a9..c821"
}Token is valid. Scope is allowed. The request goes straight through. Nothing in the path knows the rule the agent is about to break.
No precondition was ever checked. A 30-second reversal becomes a 30-day legal recovery. The agent doesn't even realize anything is wrong.
Marketing fires. The BI table drifts. Forty-one finance invoices lose their reference. The ledger debit/credit drifts $58K. Nobody notices for nine days.
Four log streams, no cryptographic link between them. Two engineers, fourteen days, one incomplete picture. The regulator stays skeptical.
{
"policy_id": "PL-887234",
"amount_usd": 58000,
"reason": "customer_request",
"idempotency_key": "f3a9..c821"
}The request is intercepted before it reaches any system of record. Identity, scope, agent, and session are bound to the call.
Scope, idempotency, cost, reversibility, cascade, semantic drift, authority. Six pass. One fails — reversibility, because the settlement window closed 2h 14m ago.
A human reviewer is routed in with the full context — including the recovery cost if they approve anyway. Their decision is signed against the rule it crossed.
A 2 KB, hash-chained, externally witnessed entry. Provable to your regulator in 90 seconds. Tamper any field — the chain breaks, mathematically.
{
"policy_id": "PL-887234",
"amount_usd": 58000,
"reason": "customer_request",
"idempotency_key": "f3a9..c821"
}The agent did exactly what its API allowed. Aarvion enforces what your business allows — and proves it, for every call, forever.
Who it's for
Aarvion gives every stakeholder a straight answer to the question that's been blocking your AI rollout.
Stuck AI initiatives move out of compliance review and into production. The same rules apply to every agent you ever deploy — internal, vendor, or yet-to-be-built. No more explaining yourself to the board.
Where Aarvion fits
You wouldn't run production without Identity. You wouldn't run production without Observability. As AI agents enter your systems of record, there's a third layer that becomes just as non-negotiable.
“Who is the agent?”
Every modern enterprise already trusts a layer that proves the identity of a human or a service. Without it, you can't even start.
“How fast is it running?”
And every modern enterprise already trusts a layer that tells you how the system is performing. Without it, you can't operate at scale.
“What was decided · why · by whose authority?”
The AI era needs a third foundational layer. One that proves not just who the agent is, or how fast it ran, but what it was allowed to do, what it actually did, and on what authority. Aarvion is that layer.
Who it's for
Built for teams putting AI agents into production in regulated environments.
Design partnership
We're onboarding a small cohort of regulated enterprises. You bring the AI initiative your CISO won't sign off on. We deploy a proxy around it and prove it's safe to ship.
Pick one stuck AI initiative. We define one operational surface.
Workshop to map endpoints, regulatory logic, and cascade. You keep the manifest either way.
Aarvion proxy observes real traffic inside your VPC. Zero impact on SLAs.
Bounded subset goes live. Mock regulator query produces a signed PDF in 90 seconds.
Frequently asked