Every action
your AI agents take -
governed before
it executes.
Formael is the layer between your AI agents and the systems they act in. Agents say what they want done; Formael checks it against your policies, carries it out without ever exposing a credential, and records what happened - and why.
Intent
The agent says what it wants to accomplish - no credentials, no provider names, no API schema
Policy
Four axes weigh every request as it arrives - Identity, Semantic, Fiscal, Risk. All four must pass
Execute
Routed to the right system with credentials the agent never sees - and the whole chain recorded
Built on boundary infrastructure
The problem
AI agents are reasoning at scale.
Your boundaries aren't ready.
The bottleneck to scaling AI agents was never reasoning. It's the absence of a formal boundary between what an agent decides and what it does in the real world - today that boundary is glue, not infrastructure.
Every AI agent in production today has a direct path to the external systems it acts upon. There is no formal interception point - no layer where the agent's probabilistic output is authenticated, validated, and transformed into a governed API call. The agent and the external world are one circuit.
- Credentials embedded in agent code or context - one prompt injection from exfiltration
- Agents must understand provider-specific APIs, schemas, and error codes that pollute their reasoning
- Switching providers means rewriting agent logic, not updating a configuration
- No stable intent abstraction exists - governance has no consistent surface to attach to
An agent's probabilistic reasoning flows directly into deterministic, side-effecting API calls with nothing in between. No policy engine evaluates whether the action is authorized. No approval workflow gates irreversible operations. No immutable record links what the agent did to the reasoning that produced it.
- No runtime policy evaluation - every agent action is unrestricted and unaudited by default
- No human-in-the-loop path for irreversible, high-value, or sensitive operations
- No tamper-proof audit trail linking each action to the exact policy that approved it
- No fiscal enforcement - agent spend has no ceiling, no circuit breaker, no visibility
Both failures trace to one structural gap: no formal execution boundary exists between an AI agent's reasoning and the external systems it acts upon. Formael closes that gap.
How it works
Intent in.
Authorized action out.
Every agent action runs one cycle: intent in, outcome out, recorded once and never altered. Policy decides on the contents of the request - so the same three steps govern a Slack message and a six-figure payment.
Intent Submission
The agent speaks intent. Never implementation.
The agent submits a structured IntentEnvelope - a three-part semantic tuple, typed parameters, and its own reasoning context. No credentials. No provider name. No API schema. The envelope has no field for secrets by design.
Intent Envelope
contracting·send·for-signature
“Finalize partnership agreement before Thursday's call”
Four-Axis Policy Evaluation
Governance happens here. Every time.
Before any action reaches an external system, the policy engine intercepts and evaluates it across four independent axes. Every axis must pass. The verdict is the conjunction - no axis compensates for another's failure. No exceptions. No fast paths.
Identity
Is this agent authorized for this capability in this context?
Semantic
What does this intent mean - and is that permitted?
Fiscal
Can the org and this agent afford the consequences?
Risk
If this goes wrong, how bad is it?
Authorized Execution
Approved. Executed. Permanently recorded.
Once approved, Formael resolves the organization's provider binding, injects credentials from the secure vault - exclusively, for this execution only - and executes against the external system. The result is normalized and written to the immutable ledger alongside the full dual trace.
Supported adapters
Resolves to the right connector for your configured provider - declarative specs, no agent changes.
Platform capabilities
Governance infrastructure
built for the agentic era.
Not middleware. Not a proxy. Not an MCP gateway that checks who is at the door. A complete execution boundary that evaluates every action on its way out - policy, connectivity, fiscal control, and a dual-trace record, in one place.
Four-Axis Policy Engine
Every intent weighed across Identity, Semantic, Fiscal, and Risk - using the actual contents of the request, at the moment of the call. All four must pass. There is no bypass path.
Dual-Trace Audit Ledger
Every action carries two linked traces: the agent's reasoning (why it acted) and the platform's execution record (what exactly happened). Audit you emit on the way through, not audit you reconstruct after. Append-only, forever.
Intent-Shaped Connectivity
Agents act against capabilities - verbs like create an invoice or send for signature - never provider APIs. Swap DocuSign for PandaDoc, or Jira for Linear, without changing a line of agent code. Your surface grows with the business, not the catalog.
Human-in-the-Loop Approvals
High-risk actions pause for human review without blocking the agent. It receives a deferred receipt and keeps reasoning while the right team - routed by domain - resolves the request.
Dual-Ledger Fiscal Control
Two independent ledgers - platform spend in USD and action value in any currency - checked synchronously on every IEC. Define limits per org, per agent, or per domain.
MCP-Native Access
The front door, not the decision. Agents that speak MCP connect with zero Formael-specific code, presenting tokens from your own IdP and discovering only the capabilities their scope allows. Evaluating this action, with these arguments, right now is Formael's job - not the protocol's.
Observability
Not just what happened.
Exactly why it was allowed.
Every action carries a dual trace - the agent's reasoning and the platform's execution record, linked by one ID. The “why” is gone the moment a request finishes, unless the system emits it on the way through. So Formael does - permanently, for every action.
Policy axis summary · sample data
pass rate
pass rate
pass rate
HITL triggered
“When an agent acts, two questions matter: why did it want to do this, and what exactly did the platform do about it? Formael answers both - permanently, for every single action.”
Formael · Dual-Trace Design Principle
Connectivity
Connect your agents
to everything that matters.
Your agents target a capability - create the ticket, update the deal, send the contract - and Formael resolves it to the right provider, injects the credential, and normalizes the result. The agent never learns a provider's API, and never holds its keys.
Agents draft, route, and dispatch contracts and NDAs - with policy-gated approval before any signature envelope leaves your organization. Irreversible actions default to HITL.
Example agent intent
"Draft a mutual NDA for Acme Corp and send for signature"
Agents create tickets, escalate incidents, and assign work - with semantic policies that restrict which priorities and projects agents may act upon, and risk policies that gate P1 escalations.
Example agent intent
"Create a P1 incident ticket and page the on-call engineer"
Agents update deal stages, create contacts, and log activities - with identity policies ensuring each agent operates strictly within its authorized scope of records.
Example agent intent
"Update the Acme deal to Closed Won and log the final call notes"
Agents send messages, create channels, and notify stakeholders - with risk policies that catch mass-blast patterns and destination policies that block unauthorized external channels.
Example agent intent
"Notify the #security channel about the anomalous login pattern detected"
Need a connector that isn't listed? Build a custom adapter in declarative YAML →
Built for every team
One boundary.
Value for everyone it protects.
Stop managing APIs. Start shipping agents.
Your agent says what it wants to accomplish; Formael handles provider selection, credential injection, retries, and error normalization. Agents that speak MCP connect with zero Formael-specific code - and onboard through the identity they already have.
- One stable vocabulary of capabilities - learn a verb once, not a provider API
- Credentials live in the vault, never in agent code or context
- Idempotent execution with semantic fingerprinting and dedup
- Agents authenticate with tokens from your own IdP - no key sprawl
One choke point. Zero bypasses. Complete audit.
Every outbound agent action routes through a single, un-bypassable policy engine. No agent, no workflow, and no API path circumvents it. Every verdict is permanently linked to the exact policy that produced it.
- Structural guarantee: no execution path bypasses governance
- Decisions made per intent, on the contents of the call - not just access at connect time
- Versioned policy snapshots - any verdict is forever reproducible
- Append-only audit, with HITL routed to the right domain team
Scale your agent fleet without scaling your risk.
Move from one-off agent experiments to a governed, observable fleet - on a boundary you don't outsource to a model vendor. Your model, your identity provider, your audit trail.
- Per-agent scope, budget limits, and lifecycle management
- Federated identity - your fleet onboards via your existing IdP, no per-agent keys
- Bring your own model and provider - switch with a config change, not a rebuild
- Every action becomes evidence the platform can learn governance from
Early Access
Build the AI agents
you actually want to ship.
Join the Formael early access program. Get the boundary your agent fleet needs - governed execution, an append-only audit trail, and a neutral control plane you own - before you have to build it yourself.
Your Agent
Semantic intent envelope
Formael
Govern · Execute · Trace
External APIs
DocuSign · Jira · Slack…