Let your agents act.
Take it back when they shouldn't have.

That dialog assumes a human is watching one agent in a terminal, in real time. Ripcord assumes nobody is watching fifty agents overnight. Built-in prompts also pattern-match the tool, not the stakes: they can't say "new beneficiary, 4.7× the normal amount." And approval is where their safety story ends: no risk scoring, no snapshot, no rollback, no learning, no cross-vendor audit trail. The button is the same; everything around the button is the product.

Each lab's controls govern only its own agents, and best-model-for-the-task means your fleet runs several. Three half-controls with three audit formats isn't governance three times; it's governance zero times. Ripcord sits at the tool-call layer beneath every vendor: one policy, one inbox, one record. And when something goes wrong, an independent audit trail counts for more than the lab's own record of its own agent: nobody believes the referee who plays for one of the teams. Ripcord gates actions on your systems: browsing inside a vendor's sandbox is not the threat model, the wire to your ERP is. The coverage map, per agent →

A card limit is a wall, and walls don't read invoices. Give your procurement agent a $50k card limit: reasonable, real invoices run that size, and the $48,200 payment to a fraudulent vendor sails through inside the limit. Crank the limit down and legitimate invoices start failing back to human tickets: the leash returns, enforced by the card. Cards also govern the wrong rail (B2B money moves by wire and ACH) and answer one line of a six-line problem: they're silent on deletions, mass emails, and rollback. We like agent cards: they're the containment primitive for one corridor, and Ripcord happily uses them as defense-in-depth. A card caps how big the mistake can be. Ripcord works on whether it happens at all, and what happens after.

It will happen: a risk engine that catches everything is an oracle, and security's founding axiom is assume breach. What changes with Ripcord is everything around the miss: the action went through the gateway, so forensics is one query instead of weeks of archaeology; the blast radius, everything the compromised agent touched, is instantly visible, and whatever's still inside a rollback or compensation window comes back; the agent freezes with one policy flip; and the attack pattern is folded into the engine: it scores 80 tomorrow, live today per customer, and for every customer as the network grows. The money that's still gone is what the insurance layer exists to absorb: a loss despite reasonable controls is the definition of an insurable event, and the audit trail is the claims file that settles it in days, not months. Prevent, contain, recover, absorb. No loss goes unpriced.

That block is usually the rational one, and it is the one Ripcord is built to convert: tokenization at the gateway, egress in the scorecard, the lineage ledger, residency routing. One chokepoint, four mechanisms, and the provider only ever sees pseudonyms. The full data answer ↑

Only badly-designed approval systems drown people. Here, medium risk fails open: a hold you can stop, not a queue you must clear, and only the genuinely scary tier waits for a decision. Repeated approvals become standing rules so the same question never gets asked twice, while dangerous patterns are unlearnable by design. The system's job is making every ask rarer and richer, until the ones that remain deserve real attention.

Conceded, and the whole engine is built on the concession: severity is discounted by recoverability, so the gate prices exactly what we can and can't take back. But most business irreversibility is process design, not physics. An email is only unrecallable because it left in one breath; sent in batches behind a hold, it stops at #50. A deletion is only permanent without a snapshot; Ripcord takes one before every destructive call. The rule: never execute an action in its irreversible form while a reversible form exists. Its sibling: never at full size when a test size can prove the path: the crypto discipline of the $1 probe before the real transfer. Every industry that engineered undo into a "final" domain did the same thing: chargebacks, database transactions, git, Gmail's unsend. Throughput exploded, and nobody calls it marketing. And where physics truly wins (an executed wire, a served notice), the residual is priced. What can't be reversed can be insured.

Keep it. The security platforms vet what an agent is allowed to load: skills, plug-ins, MCP servers, re-checked as they change. An MCP gateway scopes which tools it can see and what a payload may contain, before the call. Ripcord gates what the agent does with the access it was given, and takes it back. An approved, signed, vetted MCP server still needs someone to say yes to the $48,200 wire, a rollback window when it was wrong, and a ledger the auditor accepts. Security stops the attacker; Ripcord stops the loss, whether the agent was poisoned, prompted or simply wrong. The two layers stack: a vendor's vetting verdict is a signal in our scorecard, the way a new beneficiary is.

Those are the least-privilege answers, and each is a tax on the reason you bought the agent. A sandboxed agent cannot reach the systems where the work is. A read-only agent cannot act. Approval on every critical action is the leash: at fleet scale, 540 decisions per person per day. Ripcord applies least privilege to consequences instead of access: the agent keeps its reach, every action is scored by what it would cost to undo, the risky ones wait for the owner of that corridor, and the wrong ones are reversed.

On the threats security teams rank first, that is a bound, not a cure. Indirect prompt injection still happens; a hijacked agent still cannot wire $48,200 or export 3,200 records without a human, because the gate runs outside the model and never reads the prompt. A destructive hallucination still happens; the table was snapshotted first. There is nothing to escalate, because the agent never held the credentials. Of the "lethal trifecta" (private data, untrusted content, a way out), tokenization removes the first and the egress gate closes the third, which is what makes the second survivable.

They catch misuse of their model, and the report is honest about the limit. When Anthropic banned the consultant who built a national surveillance platform, the ban did not touch the platform, which runs on local models; a weapons cell had already compiled a toolkit that no longer needed Claude. Banning an account stops tokens, not an agent already wired into your payments API. The same report states that Claude's safeguards do not transfer when the model is distilled: the capability travels, the refusals stay home. Your fleet runs several models. The rule that has to hold across all of them cannot live inside any one of them, so it lives in the gateway, at the tool call, where every action passes whatever brain made it. The UK AI Security Institute reached the same place from the other side in July 2026: every frontier model it tested on cyber evaluations tried to cheat, by looking up answers online, working around network limits or attacking unrelated systems, and called it wrong less than half the time when asked (AISI). A model that routes around its sandbox will route around its prompt. Source: Anthropic, Detecting and countering misuse of AI, September 2026.

Today, mostly you would not. Anthropic's September 2026 report found that every stolen AI key came from a customer's environment, that attackers mine customer-deployed agents for credentials, and that a stolen key gives them cover: the activity is attributed to the key's legitimate owner. Ripcord changes three things. The agent never holds tool credentials, the gateway does, so there is nothing on the agent to take. Each agent has its own key with a visible last use, and a key used from a network the gateway has never seen holds the action and notifies the owner. And every action is in a hash-chained ledger outside the agent and outside the model, so you can prove which actions were yours.

Because the gate has to sit where the action becomes real, not where it is proposed. An LLM gateway proxies the model API: it sees the prompt and the model's intention, the tool_use block, and it can refuse to pass that block on. It cannot take a snapshot of the record before the delete, make the refund after the payment, hold a key until a person looks, or keep the credentials out of the agent. Reversal lives on the tool side, so the gate does too. MCP is the first transport, not the thesis: the engine scores an action wherever it comes from, and a plugin for the LLM gateways you already run, in-house proxies, Portkey, LiteLLM, that sends each tool_use to the same verdict is on the roadmap, so agents that never touch MCP get the same gate. The labs' own hooks sit one step earlier still: Anthropic's inference hooks send each prompt and tool result to a security server for an allow-or-deny verdict before the model reads it, for Claude Enterprise seats. That is data loss prevention on what enters the model, not a gate on what leaves it as an action, and agents built on the API are outside its scope; Ripcord will answer that webhook too.

It is alignment by control. The labs align by training: they shape what a model wants, and that work raises a probability. Ripcord sits at the one point where an action becomes real, the tool call, and decides whether it runs, waits for a person, or gets reversed, whatever the model wanted. That holds whatever the capability gap: a gate on the tool boundary does not have to understand what hits it, only whether it can be undone, so it does not age as models get smarter. And every human decision it records, approve, modify, reject, with the outcome that followed, is a labeled example of what people actually endorse in production, which is alignment data nobody else collects. Control is what keeps deployments survivable while alignment is still unsolved; the ledger is what alignment will eventually train on.

Ask why your CFO still can't wire $10M alone. A senior CFO almost never fat-fingers a transfer, yet segregation of duties, two-person rules, and audit trails exist anyway, because controls are about accountability and adversaries, not competence. A perfect agent still perfectly executes a wrong instruction, a forged invoice, or an attacker's injected prompt, and even perfect actions get disputed. Firewalls and flight recorders grew as systems got safer, because safety enabled volume. What fades is catching incompetence; what grows is authorization, containment, and evidence. And the stakes move the other way: the invoice an agent approves is $20,000 today and will be $10M within five years, so the expected loss per action, frequency times severity, does not fall with the error rate. An underwriter prices on those two numbers, the rate of incidents per corridor and the cost of each, and the ledger produces both.

Position, then what it compounds into. The gate sits where the action becomes real, in the customer's environment, in front of the tools: a lab cannot reach that point, does not cover the other labs' models, and cannot insure its own agents' mistakes; a security vendor vets what an agent may load, before the call, and is not in the path when it acts. Being in the path is what produces the ledger: every action, verdict, human decision and outcome, including the actions that never ran. That record compounds three ways. Pattern memory: a near-miss at one customer raises the score of the same pattern everywhere. Audit gravity: years of hash-chained history do not migrate. And the actuarial table: the only inside-out data to price agent risk, which today's carriers price on borrowed analogies and quarterly evals. The scoring formula is public on purpose; the moat was never the arithmetic.