Design-partner program open: agent vendors selling into regulated enterprises

Your agent passed the demo. Now pass the security review.

estoppl is the control and evidence layer for AI agents. A drop-in proxy that puts hard limits on what your agent can do and signs a tamper-evident record of what it did. Answer “what can it do?” with a policy instead of a promise, and “what did it do?” with proof their reviewer verifies in 30 seconds.

One config change. Zero code rewrites. Named-field redaction strips sensitive arguments at the proxy, before anything syncs.

Bring us a stalled deal · 15 minSee what the reviewer sees →Open-source proxy
Where agent deals die

The AI security review is now 300+ questions long.

And over half of vendors report losing deals to security reviews they couldn't clear in time. Bank and insurer third-party risk teams now ask agent vendors three questions, and today the honest answer to all three is a diagram and a promise.

They ask

What can it do?

You answer, today

An architecture diagram and a scope paragraph in the MSA.

They ask

What did it do?

You answer, today

Application logs we control, in a format nobody can verify.

They ask

How do we audit it?

You answer, today

A promise that we will produce something if asked.

SOC 2 and ISO 42001 attest a company's processes, annually. Nothing attests an agent’s runtime behavior, continuously.

That gap is why deals stall for months on questions no existing artifact answers. Cloud platforms log what their own tenants' agents do, for their own dashboards. Certifications attest your processes, once a year. Nobody attests the vendor's agent to the buyer. That's the artifact the review is waiting for.

How it works

estoppl sits between your agent and the tools it calls. Every action is intercepted, evaluated against policy, signed, and hash-chained, then packaged as evidence your customer’s reviewer can verify without trusting you or us.

Agent runtime
your agent, unchanged
estoppl intercept
stdio or HTTP MCP proxy
Guardrails + signed record
enforced, hash-chained
Evidence Packet
what you send
Reviewer verifies
30 seconds, offline
Your Agents
Agent 1
Agent 2
Agent 3
estoppl proxy
Policy evaluation·Ed25519 signing·Attestation header
Allowed calls forwarded
MCP Server A
MCP Server B
MCP Server C
Blocked calls never reach upstream
Every event synced
estoppl Cloud
Dashboard
Alerting
Kill switch
WORM
Verification API

Configurable field redaction keeps named sensitive fields out of the record. Verification runs against a published JWKS. No estoppl account and no trust in our cloud at verification time.

Read the full architecture →

The artifact

The Evidence Packet

One file you attach to the security review. Their reviewer opens it, checks the signature independently, and gets an answer to all three questions without a call, a portal login, or another round of emails with your solutions engineer. The next review gets a current packet, not last quarter’s. The recording never stopped.

What the agent can do

Allow-lists, spend thresholds, rate limits, and human-review gates. Attested as the configuration that was actually loaded, not the one described in a diagram.

What the agent actually did

Every tool call, its policy decision, and its outcome, Ed25519-signed and hash-chained, so a single altered or deleted record breaks the chain visibly.

Mapped to their questionnaire

The runtime record lined up against the AI and agent-oversight sections reviewers are working from, so answers cite evidence instead of prose.

A Standing Certificate they verify themselves

Reissued continuously while the proxy is recording. Stop instrumenting and it stops being current, because a runtime log cannot be backfilled. Ed25519-signed, verifiable offline against a published JWKS. No account, no portal, no trust in our cloud at verification time.

Don't take our word for it. Take the reviewer's seat

A live packet from a demo deployer, signed an hour ago and reissued continuously. Verify the signature in your browser and watch the chain check out. Three views, in the vocabulary of the three people who tend to run the review.

Open a live packet →
Audit view
Compliance / GRC
Control view
CISO / Security
Architecture view
Head of AI / architects

Enforced, not promised

Reviewers have read enough policy documents. Every control below is enforced in the request path and evidenced in the signed log, the same record the packet is built from.

Custom Policy Rules

Allow-lists, block-lists, amount thresholds, rate limits, and conditional rules on any field. Per-agent overrides. This is the answer to “what can it do?”

Human Review Gates

High-risk tool calls pause until a human approves or denies via email, Slack, webhook, or dashboard. The gate, and who cleared it, are both in the record.

Cryptographic Audit Trail

Every tool call Ed25519-signed and hash-chained. Tamper-evident by construction. This is the answer to “what did it do?”

Remote Kill Switch

Block a tool or shut down an agent from the dashboard. Every proxy picks up the change within 5 seconds. That is the containment story reviewers ask for.

Attestation Header

Every forwarded request carries an X-Estoppl-Attestation header, so upstream servers can verify governance before they process the call.

Org-Wide Dashboard

Every agent and every deployment in one view. Event feeds, decision badges, request inspection, and the exports your customer asked for.

estoppl dashboard showing tool call events with ALLOW, BLOCK, and HUMAN_REQUIRED decisions

Watch the interception happen

estoppl intercepting Stripe MCP tool calls in Cursor, blocking a $50,000 invoice from the cloud dashboard, and writing every action to a signed audit trail. Three minutes, no slides.

Why now

The review bar moved. The artifacts didn't.

68%

of organizations can’t distinguish agent activity from human activity.

Agent deployments are outrunning the ability to supervise them. Reviewers know it, which is why the questions got harder this year.

60+

carriers moved to exclude AI risk after ISO’s January 2026 exclusion forms.

The exclusions began in 2024 and went industry-wide this year. The AI-specific policies replacing them condition coverage on documented governance evidence.

2025–26

enterprise AI questionnaires added agent-oversight sections.

Point-in-time certifications answer them once a year, at the process level. No standard exists for continuous runtime evidence, which is the opening.

Figures: CSA/Aembit identity survey (March 2026); ISO GenAI exclusion endorsements and carrier filings (2024–26); SIG 2026 and CSA AI-CAIQ questionnaire updates; vendor security-review surveys (2025–26). Full citations on request.

Built for agent vendors selling into regulated industries

The buyer is the vendor with revenue stuck behind a security review. The verifier is their customer. Both sides get the same artifact, which is the point.

Agent vendors → broker-dealers / RIAs / asset managers

“Our customer’s compliance team wants evidence covering our agent’s tool calls that fits their SEC 17a-4 / FINRA 4511 recordkeeping arrangements. SOC 2 and ISO 42001 don’t cut it. The deal has been in review for two months.”

Standing Certificate ships with the enterprise quote. Continuous tamper-evident audit trail slots into their existing D3P / recordkeeping arrangements as supplementary evidence. Their reviewer verifies the certificate independently: one command, no account.

Agent vendors → healthcare providers / payers

“Hospital procurement asks for HIPAA Security Rule evidence on our agent’s data access patterns. We don’t have a clean way to produce it, so we keep answering in prose.”

Per-tool policy enforcement + signed event chain + evidence mapped to HIPAA Security Rule technical safeguards (45 CFR §164.312). Supports your customer’s existing HIPAA compliance program. It does not replace it.

Agent vendors → federal contractors / agencies

“We’re trying to land a DoD prime. They want continuous evidence of agent action governance for ATO review. Our security packet came back rejected.”

Continuous attestation evidence on top of the Standing Certificate, mapped to NIST AI 600-1 control families. Integrates with the agency’s existing FedRAMP / ATO process. It does not certify FedRAMP itself.

The reviewer on the other side of the table

“A vendor sent me an Evidence Packet. How do I verify it independently? I don’t want to trust their cloud, or theirs, or anyone’s.”

Verify in the browser, or run estoppl verify-certificate cert.json. Fetches the issuer’s public key from JWKS, checks the Ed25519 signature offline, returns VALID plus a drill-down summary in under 30 seconds. The algorithm spec is published, so re-implement it in any language you like.

The ask

Two ways in, depending on whether you have a deal on the line or an afternoon to poke at a proxy.

Design partnerOpen now

For agent vendors

Instrument one deployment. Bring the deal it is stuck behind. We stand up the recording with you, and the packet it produces goes into that review, and every review after it.

  • ✓One config change: stdio or HTTP MCP proxy, no code rewrites
  • ✓Policy set enforced in the request path from day one
  • ✓Evidence Packet built against the questionnaire you were actually sent
  • ✓Founder-direct, roadmap influence, ground-floor terms
  • ✓Named-field redaction: sensitive arguments stripped at the proxy
  • ✓Evidence stays current: the certificate is reissued while the proxy runs, so the next review starts from live data
Bring us a stalled deal · 15 min
Open Source

For engineers

Full proxy with guardrails, signed audit trail, and local dashboard. Apache 2.0. No account required. Run it against your own agent this afternoon.

npmnpm install -g estoppl
Homebrewbrew tap estoppl/tap && brew install estoppl
View on GitHubCloud dashboard

Run vendor security reviews? We want to hear the evidence bar you wish every agent vendor met, and what would have to be in a packet for it to actually shorten your review. Tell us what would clear it →

Which deal is stuck in security review right now?

Bring that one. Fifteen minutes with the founder. We look at the questionnaire you were sent and work out what the packet has to contain to answer it.

Bring us a stalled deal · 15 minSee a live Evidence Packet

— Tina Ho, founder · ex-Netflix, ex-Amazon · LinkedIn ↗