Agent action

Nobody deletesthe Q3 reports.

VerdictDeniedRule q3-reports matched

ClassifierOnline

That sentence is a guard rule. smartplane checks it before every action your agents take through its single MCP endpoint.

Start free How the checks work

The call your agent sends. Edit it.

{
  "tool": "files.delete",
  "path": "reports/q3/summary.pdf",
  "member": "dana@acme.example",
  "agent": "claude-code"
}

Each line of the audit log carries the hash of the line before it. Change one byte of history and every hash after it stops matching.

Every call,on the record

Audit log · acmeChain verified through #1042

#1041grant.createdallowed
admin@acme.example · team:billing → billing-api (read)
prev 9f2c0b6d…a71ehash f8a4beb2…14cc
#1042mcp.tool_calledallowed
dana@acme.example · github.search
prev f8a4beb2…14cchash 8aedf067…505d
#1043policy.denieddenied by q3-reports
dana@acme.example · files.delete reports/q3/summary.pdf
prev 8aedf067…505dhash 6a5654ce…a57d
Written from your edit

What each agent gets

The switchboard of the Oulu telephone exchange, 1932.
One endpoint
Claude Code, Cursor and your own agents connect to one MCP URL with one token per member. Upstream MCP servers, HTTP APIs and databases sit behind it.
No more twelve hand-configured servers on every laptop.
DIDana ItoAnalyst · Billing · Q3 close
Listed to Dana’s agent
- github.search
- postgres.orders (read)
- billing-api.invoices
- skill: month-end-close
4 of 31 tools
Grants by role, team and project
An agent lists only what its member may use. Access composes from roles, teams and projects, and can be time-boxed.
Skills, prompts and variables are granted the same way as tools.
Punching a population card for the 1940 US census.
Databases and APIs, scoped per call
Queries and requests are proxied with the member’s grant applied on every call, not once at sign-in.
Read-only stays read-only, whatever the agent asks for.
Access request
Dana Ito asks for write on billing-api for 24 hours
You can’t approve your own request.
Approvals with four eyes
Sensitive grants can require an approval and expire on their own.
Nobody approves their own request. The button is not there for them.
Vault door, Bowery Savings Bank, New York, 1923.
Secrets agents never see
Credentials are envelope-encrypted with AES-GCM and injected on the server when a call needs them.
Plaintext never reaches an agent, a log or the API.
member.deprovisioned
sam@acme.example · via SCIM from Okta
- Membership ended
- 3 access tokens revoked
- 4 direct grants revoked
- Removed from 2 teams
Offboarding in one step
SSO and SCIM from Okta, Entra ID or Google Workspace. When someone leaves, one code path ends the membership, revokes tokens and grants, and removes them from every team.
Their agent’s next call fails.

Built for the audit
Read the security overview
Selectors at work in an Ericsson exchange, from the film Män och maskiner, 1936.
SOC 2
Controls mapped to the Trust Services Criteria from day one.
SSO
SAML and OIDC single sign-on for every member.
SCIM
Your directory adds and removes members.
SHA-256
Tokens are stored only as hashes. Every audit line is hashed into the chain.
AES-GCM
Secrets are envelope-encrypted. Data keys are wrapped by a key-encryption key.
90 days
The longest an access token lives. It dies sooner with the membership.
Fail closed
If the classifier is down and an enforcing guard applies, the action is denied.
Four eyes
Nobody approves their own access request.
Append-only
One writer per organisation. No edits, no deletes.
GDPR
A data processing agreement on every paid plan.