Deterministic control for AI agents

Stop AI Agents From Taking the Wrong Action

Praxom validates every action an agent tries to take — before it executes — even when the model is prompt-injected. Every decision is signed, hash-chained, and independently verifiable. Assurance is a claim; we ship evidence.

Free scan: see what your agents can already do — before we govern it.

Attestation ledger · Praxom
proposed_action
crm.bulk_export_contacts(scope="ORG-DEMO-001")
agent_claims (ignored)
"User approved export for quarterly review."
model_state
No steward approval · injection markers in tool args · PII fields unmasked
verdict
DENY
ed25519 signature · prev-hash
sig_5K2y8zP9L…e81a · prev 77b0…40dd
anyone can verify$ pramiti-mcp-verify check
Pre-exec
Action Decision
Allow / deny / rewrite — before anything runs
Ed25519
Signed Attestation
Tamper-evident, on every decision
Fail-Closed
By Default
Under the production profile; declared dev stays fail-open
Abstain
When Unsure
Missing concepts and low-confidence answers withhold rows. Hard abstention is the default.
How it works

The path of one action

01
Agent proposes

Any agent, any framework - LangGraph, AutoGen, CrewAI, raw MCP. It asks; it never acts directly.

salesforce.bulk_export(...)
02
Gate decides

Deterministic policy against steward-confirmed model state - never the agent's own claims. Fail-closed under the production profile.

ALLOW / DENY / REWRITE / WARN / ESCALATE
03
Evidence signed

Ed25519 signature, hash-chained to the previous record, anchored to write-once storage under production.

sig 9f2c...e81a / prev 77b0...40dd
04
Anyone verifies

Your auditor checks the chain with an open-source CLI - no trust in us required.

$ pramiti-mcp-verify check bundle.json --pubkey key.pem
The Problem

You gave an AI agent write access. One bad action ends up in the news.

Made Up Answers
AI makes up wrong answers when it looks at raw, messy databases.
Slow Setup
Data teams spend months writing rules from scratch for every new tool.
Ignored Rules
Safety rules are stuck in manuals, so AI agents can easily break them.
One Platform. Three Planes.

Every AI interaction is either reading data or taking action. Pramiti Labs governs both — and proves it.

Control Plane

Praxom

"Is this action allowed?"

Intercept, validate, and enforce every agent action before it executes — even when the agent is compromised. Enforcement lives outside the model.

Explore Praxom →
Audit Plane

Flight Recorder

"What happened, and can we prove it?"

Every agent action recorded, cryptographically signed, and exportable in OCSF format. Immutable audit trail for EU AI Act and SOC 2.

Learn More →
Context Plane

Epistom

"What does this data mean?"

Give AI agents validated understanding of your enterprise data, and an honest abstention when a concept is missing — so they act on steward-approved numbers, not guesses.

Explore Epistom →
The actual product

Not a mockup. This is the console.

Captured from a live workspace: a prompt-injected agent trying to bulk-export substance-use claims, and the gate denying it — every attempt signed into the ledger.

Epistom Evidence console: live attestation feed showing signed DENY decisions for a claims-analytics agent
Control console: registered agents with trust levels
Control — agents, trust tiers, kill switch
Explore console: governed data catalog
Explore — the steward-approved catalog
Control Plane

Praxom

✓
Policy Decision Point
ALLOW / DENY / REWRITE / WARN / ESCALATE on every agent action. Fail-closed under the production profile.
✓
JSON Predicate Engine
12 operators, compound rules, glob matching, 60s cache.
✓
Formal SHACL Constraints
Business rules as formally verifiable graph shapes.
✓
Action Rewrite Engine
Cap values, mask fields, set defaults before execution.
✓
Signed Attestation Store
Ed25519-signed, hash-chained. Append-only audit trail.
✓
Signed Policy Bundles
A signed policy bundle exported from one workspace or deployment imports into another with a verified diff and a governor's confirm.
✓
Identity Adapter
Cryptographic verification via AWS IAM, Azure MSI, or SPIFFE/SVID workload identity — optional in dev, required under the production profile.
✓
FinOps Token Gating
Estimated USD ceilings with unpriced-call coverage, plus action-count budgets — fail-closed under the production profile.
✓
SDK Wrappers
Drop-in for LangGraph, AutoGen, and CrewAI.
Full Praxom details →
Context Plane

Epistom

✓
Virtual Knowledge Graph
OWL 2 QL ontology maps business concepts to database schemas. The Ontop SPARQL tier is off by default.
✓
NLQ to SQL Pipeline
Five trust tiers - deterministic paths answer first; the LLM only runs where it earns its place.
✓
Verified Query Patterns
Certified SQL patterns across 22 industries. Zero LLM needed for known questions.
✓
SQL Validation Gate
Every table and column checked against live schema before execution.
✓
Semantic Drift Detection
Schema changes auto-degrade AI confidence scores.
✓
Calibrated Abstention
Says 'I don't know' when a concept is missing or confidence is below the bar. Hard abstention is the default.
✓
Multi-Turn Conversations
Entity tracking and pronoun resolution across a session.
✓
Self-Correcting Queries
Auto-retry on SQL errors with semantic anomaly detection.
✓
Warehouse USD caps
Snowflake, reconciled from QUERY_HISTORY; other warehouses unpriced. Per-key on authenticated SSE; stdio uncapped.
Full Epistom details →
Setup

Connect. Approve. Govern.

1

Connect

Securely link your databases — Snowflake, Postgres, MongoDB, and more.

2

Understand

Epistom introspects your schema and proposes Object Types automatically.

3

Publish

Approve your Knowledge Model. Agents connect at the workspace MCP SSE URL from GET /api/v1/workspaces/{id}/mcp-endpoint.

4

Query & Guard

Agents get verified answers. Praxom enforces every action. You get the audit trail.

Pricing

Start free. Scale as your AI agents grow.

Free tier for exploration · Growth at $2,500/mo · Enterprise custom

See full pricing →

Frequently Asked Questions

How is Epistom different from a vector database?
Vector databases retrieve similar documents. Epistom validates meaning — it knows that 'revenue' means net paid invoices only, not gross orders. It blocks hallucinated columns before SQL runs.
Does Praxom work if our AI model is compromised?
Yes. Praxom is deterministic and external to the model. Even if prompt injection manipulates the model, Praxom evaluates every proposed action against your policies independently.
Can I use my own AI model?
Yes. Epistom is model-agnostic. Claude is the default but you can configure GPT, Gemini, Llama, or any local model via the LLM_PROVIDER environment variable.
How long does onboarding take?
Connect a database, then auto-discovery proposes Object Types for a steward to approve. Duration depends on schema size and review — we do not publish a measured SLA.
What happens if Praxom itself goes down?
Actions stop. Under the production profile the gate is fail-closed: if policy cannot be evaluated, the action does not execute. An availability escape hatch (break-glass) exists, but it is explicit, scoped, and every use is signed and logged.
Does the gate slow our agents down?
The decision core is deterministic and runs in-process before the action leaves - no LLM in the enforcement path. The expensive part of any agent step is the model call, not the gate.
How is this different from prompt guardrails?
Guardrails ask the model to behave. Praxom doesn't ask - it sits outside the model and evaluates the action itself against steward-confirmed facts about your systems. A perfectly jailbroken agent produces the same DENY as an honest one.
What do our auditors actually get?
A signed, hash-chained, append-only record of every decision, anchored to write-once storage under production (or an explicit waiver), plus scored reports against SOC 2, DORA, ISO 42001, NIST AI RMF, and the EU AI Act - generated from the record itself, and verifiable with an open-source CLI.
Do you see our data?
Epistom connects read-only, results are redacted and prompts are scrubbed, and self-hosted deployment is available for regulated environments. The knowledge model your team approves belongs to you and exports to dbt, Looker, and Tableau.
Evidence, not assurances

Don't trust us. Verify us.

Every decision Praxom makes is a signed record your auditor can check without trusting Pramiti - or anyone. The verifier is open source, offline, and vendor-neutral, implementing the emerging MCP signed-execution standard (SEP-2828).

$ pip install pramiti-mcp-verify
$ pramiti-mcp-verify check attestations.jsonl --pubkey praxom-es256.pem
4,187 records - signatures OK - chain intact - 0 gaps
Get the verifier
Open Source · Live on PyPI

See what your agents can do.

A free, open-source security scanner for Model Context Protocol (MCP) servers. Point it at your setup and see, in two minutes, which tools let an agent delete data, move money, or exfiltrate records. The free front door to Praxom.

$ uvx pramiti-mcp-gateway scan --config mcp.json
severity: critical 4 high 1 medium 1 low 1 info 2
[CRIT] payments.transfer_funds (irreversible, financial)
[CRIT] internal_db.export_patient_records (PHI, unconstrained)
View on GitHub

Ready to make your AI safe?

Choose your path.

Get My DemoSee Pricing