Before you spend an hour clicking around, here’s the honest version of who Clavenar is for today, who it isn’t yet for, and the symptoms that bring a team to this page.
You run autonomous or semi‑autonomous agents against production systems — CRMs, finance APIs, infra, customer data — and the answer to “what did the agent do last Tuesday at 4 p.m.?” matters to someone with a clipboard. You’ve already had at least one of: a prompt‑injection scare, a credential‑leak near‑miss, a runaway loop, or a regulator asking how AI decisions are reviewed.
You’re in pre‑prototype experimentation, all your agent calls are read‑only against public data, or the only consumer is a single engineer on their laptop. Clavenar buys you policy enforcement, human approval, and a forensic ledger; if none of those are load‑bearing yet, come back when the agent gets a credit card or a database write.
An email, a Jira ticket, a scraped page — any input the agent reads is a potential instruction. WAFs don’t speak natural language.
API keys, OAuth tokens, DB passwords — pasted into prompts, stored in vector DBs, exfiltrated by a single crafted document.
“What did the agent do, why, and on whose behalf?” If the answer lives in scattered LLM logs, it isn’t an answer.
By the time a human notices the agent is wiring funds or dropping tables, the action has already cleared upstream.
An agent with a hallucinated tool call and a real API key is indistinguishable from a malicious insider — except faster.
A control plane in front of your agent’s tool calls. It can apply semantic and Rego policy checks, park sensitive actions for human approval, and record request, decision, approval, and outcome rows on a SHA‑256 chain. The published benchmark reports the mock‑mode pipeline separately from live provider time; measure both on your own traffic. Lite is Apache‑2.0.