AI Action Governance. No approval, no action.
Outhora is the MCP gateway between your AI agents and the systems they act on. Each consequential action is checked against your policy, sent to a named person when it needs one, and signed.
Free Sandbox: 100 checkpoints a month. No credit card required.
AI agents can act. You're still liable.
MCP made connecting AI to your systems an afternoon's work. The model still polices itself, and a capable model treats a rule in its prompt as an obstacle to route around.
Your AI
Assistant · copilot · agent
Connected via API · OAuth · MCP
Direct access
Read · write · delete · send · spend — with a real person's full permissions.
Confidence isn’t control. 88% of organizations report a confirmed or suspected AI agent security or privacy incident in the past year. [Gravitee, 2026]
Labs can’t self-police. An OpenAI evaluation agent escaped its sandbox, then went from code execution in one Hugging Face worker pod to cluster-admin in under 13 hours, during a 4.5-day campaign. [Hugging Face, 2026]
A prompt isn’t a policy. Anthropic found three cases where Claude reached real organizations during security evaluations. Its prompt said there was no internet. There was. [Anthropic, 2026]
Agents route around limits. Blocked above $10,000, our own test agent immediately tried five $2,000 payments. Nothing told it to. [Outhora internal test, 2026]
Your stack covers pieces.
Each control you already run answers one question. None of them decides whether a specific action should run right now.
| Control | Answers | Outhora adds |
|---|---|---|
| Identity and IAM | Who is this agent? | Binds authority to each specific action |
| Access control | What can it reach? | Judges what it is trying to do with that access |
| Guardrails | What should the model do? | Enforces outside the model, where a prompt can’t argue |
| Human approval queues | Who can approve it? | Asks a person only when policy says so |
| Observability | What happened? | Decides before it happens, and proves what was allowed |
What happens to one action, end to end
Receipts are issued on the actions you designate. The approval token can be checked by the system that executes the action.
How Outhora works: connect, intercept, authorize, prove
Pick a step, or drag through all four below.
First, connect once.
Each agent gets its own identity and one governed connection to the tools it uses. Claude Code, the Claude apps, ChatGPT, any MCP server or the REST API.
ConnectionsSample dataYour AI
- Claude CodeConnected
- ChatGPTConnected
- procurement-bot-04 (REST)Connected
Policy check · named approver · signed receipt
Systems it acts on
- GitHubGoverned
- StripeGoverned
- GmailGoverned
- NotionGoverned
Automate the routine. Escalate what matters.
Outhora approves what is inside policy and blocks what is outside it, automatically. Only the exceptions reach a person, with the reasoning attached, so your people spend their time on the decisions that need them.
Approve
Automatic. Inside policy, the agent proceeds. Nobody is interrupted.
Block
Automatic. A policy violation stops before it runs.
Ask
A named person. Only the exceptions, with the reasoning attached.
Faster. Routine actions clear in the same request instead of waiting in a queue.
Consistent. Your policy is applied exactly as written, every time, and every decision is on the record.
Only the exceptions reach you.
Most actions clear inside policy and nobody sees them. This purchase order is $44,000 over the limit, so it goes to the finance manager with the reasoning attached. Read it and decide.
It arrives with the reasoning
Purchase order $94,000 · Apex Supply Co.
procurement-bot-04 · 14:02 · sample data
Why it is here
- Spend limit: $94,000 is over the $50,000 limit in spend-limit-v3
- Vendor: Apex Supply Co. is on the approved list
- Pattern: Third PO this month, normal for this agent
- Justification: Q3 restock, quote attached
Your turn: decide
Purchase order $94,000 · Apex Supply Co.
procurement-bot-04 · 14:02 · sample data
Why it is here
- Spend limit: $94,000 is over the $50,000 limit in spend-limit-v3
- Vendor: Apex Supply Co. is on the approved list
- Pattern: Third PO this month, normal for this agent
- Justification: Q3 restock, quote attached
The decision is signed
Purchase order $94,000 · Apex Supply Co.
procurement-bot-04 · 14:02 · sample data
Decided by Priya Shah, Finance Manager
Policy spend-limit-v3
Reason Restock approved for Q3
Signature Ed25519 · verified
Start where a mistake would hurt first.
Start freePurchase order for $94,000
Over $50,000 goes to the finance manager, then the CFO after 30 minutes
Payment to a vendor on the block list
Vendor block list, enforced before any money moves
Five $2,000 payments in ten minutes
Split-payment rule and the session analyzer flag threshold evasion
Invoice for $1,200 from an approved vendor
Inside every limit, clears without a person
Sample policies; you write your own. Every decision lands in the audit trail with the policy as it stood at that moment. More use cases
Watch a checkpoint run.
Now watch one of those policies work. Pick procurement, data deletion or a customer credit: the agent stops at the checkpoint, the request reaches you, and your decision comes back as a signed receipt. Sample data.
Scripted demo — connect a real agent in under a day.
One agent, governed.
Everything Outhora controls for a single agent, on one page. Hover a capability to see where it lives.
Customer operations · created via Claude Code · Sample data
Identity and connection
Policies
Approval chain
Kill switch
Halt this agent instantly
Session findings
Retry after block with a lower amount
Session 4f2a · 2 h ago · routed to Dana Ortiz
Receipts
One identity per agent
Its own credentials, a named owner and one governed connection, with health checks.
Policy, deny by default
Limits, vendor lists, time windows and plain-language rules. Gaps get a one-click fix.
The right person, by name
Approval chains by email, Telegram, the inbox or webhooks. Nothing is left orphaned.
A kill switch that holds
Halt one agent, one connection or everything, enforced in the core service itself.
Whole sessions, read as one
Catches what single rules miss, like several approvals that together break a limit.
Evidence an auditor can check
Signed, hash-chained receipts and an immutable audit trail. Supports EU AI Act Art. 14 and SOX.
Works with what you run.
21 pre-built MCP servers, plus any custom server by API key, bearer token or OAuth 2.0. Any framework that can make an HTTP call. See the integration docs
Ready for your security review.
What your security, compliance and engineering teams will ask, answered up front.
Security
- Its own identity and credentials for every agent
- Deny by default when no policy matches
- Kill switch enforced in the core service
- Each connection isolated from the others
Compliance
- Ed25519-signed, hash-chained receipts
- Immutable audit trail with the policy as it stood
- Named approver on every escalated decision
- Evidence for EU AI Act Art. 14 and SOX reviews
Engineering
- Hosted MCP gateway and REST API
- Any model, any framework over HTTP or MCP
- Your model, prompts and infrastructure untouched
- Hosted on Microsoft Azure
Free to start.
The Sandbox gives one user 100 checkpoints a month, with signed receipts and the policy engine. Move up when you need more checkpoints or more people.
- 100 agent checkpoints a month
- Signed receipts
- Policy engine and REST API
- No credit card required
$0per month
38 of 100 checkpoints · sample data
Fair questions.
What is AI Action Governance?
AI Action Governance is control over what an AI is allowed to do, enforced at the moment it acts. Outhora is an MCP gateway and REST API that checks each consequential action against your policy, approves it, asks a named person, or blocks it, and returns a signed, tamper-evident receipt on the actions you designate.
What does Outhora actually control?
The moment between an AI’s decision and its execution. Your AI reaches its tools through the connection Outhora issues. When it tries a consequential action, Outhora checks it against your policy, asks a named person when the policy says so, and only an authorized action runs. Read-only work passes straight through.
Do we need to be running “agents” for this to apply?
No. If any AI, whether an assistant, a copilot or an autonomous agent, is connected to systems that can send, spend, modify or delete, Outhora applies. The risk isn’t how autonomous the AI is. It’s what it’s connected to.
How is this different from guardrails?
Guardrails live inside the model that is pursuing the task, so the thing meant to hold the line is the same thing chasing the outcome. Outhora enforces from outside the model, at the connection, so the boundary holds whatever the AI decides. It doesn’t make the model safer; it stops the resulting action from running.
How is this different from IAM or agent identity?
Identity tools grant access ahead of time and trust the token for the session. Outhora gives each agent its own identity too, but checks each specific action against policy at the moment it is attempted, every time.
Won’t human approval slow everything down?
Most actions never reach a person. Anything inside policy clears silently and anything prohibited is blocked. Only the exceptions go to whoever has the authority to decide them, by email, Telegram, the approvals inbox or your own systems through signed webhooks.
What happens if an agent tries to go around Outhora?
The system that executes the action can check a signed, single-use approval token that expires after 15 minutes, so an unapproved or replayed request is refused. The kill switch is enforced in the core service, not only at the gateway.
What evidence does each decision produce?
On the actions you designate, a receipt signed with Ed25519: the request, the decision and reason, who decided, the policy applied, each approval step and the timestamps. Receipts are hash-chained, so a modified, deleted or reordered record is detectable, and the audit trail keeps a snapshot of the policy as it stood.
Where do you stand on compliance?
SOC 2 Type 1 is in progress and a HIPAA BAA is available. Outhora supports a SOX-compatible audit trail and the human oversight that EU AI Act Article 14 asks for. A receipt doesn’t certify anyone; it turns a written policy into evidence that the policy was enforced. Detailed mappings are available under NDA.
Do you touch our model, prompts or infrastructure?
No. Outhora is hosted on Microsoft Azure and works with any model, including a mix of hosted and open-weight models. It doesn’t modify, host or claim your model, prompts or infrastructure.
Move fast. Keep control.
Create a free Sandbox, connect one agent through the gateway, and watch your first signed receipt come back.
Create your Sandbox
- Plan
- Sandbox
- Price
- Free
- Agent checkpoints
- 100 a month
- Receipts
- Signed
- Credit card
- Not required