​

Arclasp

Your agents act together. Govern them that way. Arclasp is a runtime governance layer for consequential AI-agent actions. It watches what your AI agents do across an entire workflow — cumulative spend, external calls, risky actions, which agents have run, what domains they’ve contacted — and applies policy to the whole chain, not just one tool call at a time. When something crosses a threshold you’ve set, execution pauses for human approval before it runs. Policy decisions are made authoritatively by the Arclasp backend, not by code running in your process.

​

The problem Arclasp solves

Most AI safety tools evaluate one tool call at a time. That misses the failure mode that actually matters in production: agents that each look fine individually but commit you to something serious in aggregate. A research agent looks up vendor pricing. A negotiation agent calculates an offer. An email agent drafts the message. A commitment agent records the deal. Each step passes its own per-call review, and the chain quietly hands a vendor $50,000 with no human in the loop. Chain-level governance is the difference between catching that and not catching it.

​

What you get

• Cumulative tracking across the whole workflow — financial exposure, external communications, records modified, privileged actions, tokens used. A $4,000 charge looks fine alone; the same charge after three other$3,000 charges should require approval.
• Backend-authoritative policy evaluation — every governed action is decided by the backend, not by code running in your process. That’s what makes the audit trail and the decision trustworthy from an outside observer’s perspective.
• Blocking human approval gate — when policy says a human needs to sign off, your code actually blocks until they do. The approver decides from the authenticated dashboard (with an optional email notification), and the workflow resumes.
• Tamper-evident audit receipts — every chain closes with an HMAC-signed, hash-chained receipt. Public sharing uses opaque verification tokens, while authenticated users can verify receipt integrity through the v2 API.
• Open-source SDK — the client library that talks to the backend is Apache 2.0, so you can read exactly what it sends and how it enforces decisions. Read it before you install it.

​

Who this is for

Anyone running AI agents in real systems. If you’re building with LangGraph, LangChain, CrewAI, MCP, or your own orchestration, Arclasp fits. Solo developers, small teams, and startups all qualify. You don’t need to be at scale to want this — you need to be one chain of agent decisions away from a problem you can’t take back.

​

How it works

Two components: an open-source SDK that runs in your Python process, and a hosted backend that is the sole authority for policy decisions, plus dashboard UI and audit log storage. The SDK handles chain lifecycle and payload sanitization, then sends every action to the backend for a real decision — there is no local governance decision path in the current architecture. If the backend is unreachable, the action does not execute; see Limitations for exact failure behavior.

​

Where to go next