The person approved something else
Approve says yes to a description. The details change after the click.
Underwrit binds approval to the exact arguments. Any change, no run.
Beta Public beta. Free for one team and one environment; Underwrit Cloud for the fleet.
Let AI agents act. Keep the proof.
A checkpoint between AI agents and their tools. Routine actions pass, risky ones wait for the right people, and every decision is sealed into a record anyone can verify offline.
allowed routine, goes straight through
recorded runs, and is noted for review
held waits for the people your policy names
denied never runs
Why this is hard
"A human approved it" and "the log says so" are weaker than they sound.
Agents now send email, move money and change production. Here is where approvals and audit logs break.
The instruction came from a stranger
A hidden line in a ticket steers what the agent does next.
Underwrit checks who named the recipient. A stranger? A person decides.
The log is a table someone can edit
Whoever runs the database can rewrite history unseen.
Underwrit chains and signs every entry. One changed byte fails the check.
How it works
Follow one refund from request to proof.
A $4,800 refund. Policy: over $1,000 needs two people. Press play.
1 / 7
The agent asks to act
The runtime sends the call to Underwrit before any tool runs.
Underwrit sees it before anything happens, not after.
2 / 7
Underwrit checks where each value came from
Customer and amount came from the user. But $4,800 is over the limit.
We call this influence is not authority: content can suggest, only people can decide.
3 / 7
It holds the action
Verdict: held. The agent pauses; two named people are asked in the console, Slack or Teams.
Verdicts: allowed, recorded, held or denied.
4 / 7
Two people approve the exact action
Priya and Sam approve this exact call, this policy version, until 15:00.
The overlap in our logo is this moment: two people agreeing.
5 / 7
The runtime claims the approval, just before it runs
A changed amount is refused. The matching claim runs once.
An approval is a contract, not a flag.
6 / 7
Every step is sealed into the record
Signed by your plane, cosigned by witnesses, timestamped.
Signed with Ed25519, witnessed, timestamped with RFC 3161.
7 / 7
Anyone can check it, offline
The pack carries its own verifier. No account, no network, no trust needed. Then edit one byte and run it again.
Or drop the pack on the browser verifier, linked under Get started.
1/7
Governance you can read
A policy is a short list of rules, not a model's mood.
Templates, your limits, plain words. Same call, same verdict, every time.
Money movement template · policy v14 enforcing
- Refunds, payouts and transfers are high consequencechecked closely
- The payee and the amount must come from a person, not from something the agent readelse hold
- Hold a single payment above $1,000hold · 2 people
- Hold when one session's payments add up past $5,000hold · 2 people
- Approvers state who is paid and how much first; the requester and the policy's author cannot approvequorum rules
- Everything else runs, and is recordedallow
call 1 of 5finance-agent
45 templates, each also a signed pack past the first seven: coding agents, package installs, MCP servers, Kubernetes, Terraform, cloud IAM, CI/CD, refunds, AP2 mandates, accounts payable, Slack and Teams, CRM, support, HR, finance, data retention, incident response, SOC 2, GDPR, PCI DSS, HIPAA, the EU AI Act, DORA and SEC 17a-4. Templates never switch enforcement on and never loosen what you already wrote. A new environment starts monitoring only, and the what-if replays your recorded traffic under a draft before you apply it.
The record
A record nobody can quietly change. Not even us.
Every entry fingerprints the one before it. Edit one and the chain breaks. Try it.
✓ 6 entries verify. Chain intact, signed, witnessed. Build: signed release.
Editing the record breaks the chain. Editing the software that writes it shows too: every pack carries a signed statement of the build that made it, and the verifier warns about a modified build or an install over its free limit.
- PostmarkA time authority stamps when. No backdating.RFC 3161
- Second notaryWitnesses countersign the log's size. Deletions show.cosignatures · consistency proofs
- SealYour plane signs the chain with its own key.Ed25519 checkpoints
- ChainEach entry carries the one before it.hash chain · Merkle log, RFC 9162
What a pack proves
- No entry present has been altered or reordered, and no file in the pack was edited.
- Each entry sat at its stated place in the log, under a checkpoint your plane signed.
- The log only grew since a witness last saw it.
- A lawful erasure shows as an erasure, with who authorised it and why, instead of looking like tampering.
- Which build of Underwrit made it, and whether that is the release we signed.
What it does not claim
- That the record is complete. Only the entries present can be checked.
- Who made it, from the pack alone. Pin your plane's public key when you verify.
- That the world matched the record. It records what the tool reported back, and keeps that separate from whether someone checked the outcome.
For auditors and compliance
Evidence an auditor can test, mapped to the frameworks they use.
Their own workspace: pick a framework, draw a reproducible sample, test, sign.
SOC 2
7
controls mapped, from access to change management.
CC6.1 CC6.2 CC6.3 CC7.2 CC7.3 CC7.4 CC8.1
ISO/IEC 42001
5
Annex A controls for an AI management system.
A.3.2 A.6.2.6 A.6.2.8 A.9.2 A.9.4
EU AI Act
4
articles on record-keeping and human oversight.
Art. 12 · Art. 14 · Art. 14(4)(e) · Art. 26(6)
NIST AI RMF
5
subcategories across Govern, Measure and Manage.
GOVERN 1.4 2.1 · MEASURE 2.8 · MANAGE 2.4 4.1
1Openframework · period · controls
2Sampleseeded, reproducible
3Testchecks read from the record
4Signa workpaper you can verify
Enterprise adds
Regulator exports: EU AI Act Art. 12 and 73SEC 17a-4FINRA 4511DORAStatistically sized samples, Merkle-provenFirm workpapers
The mappings are our reading of each framework, not a certification. Whether a control is in scope, and whether the evidence is enough, is the auditor's call.
Where your data lives
Decisions stay on your side. The cloud never sees an argument.
The data plane decides next to your agents. The control plane is never in the path.
Your cloud
Data plane
Next to your agents. Decides every call.
- arguments, sessions, the full record
- holds and approvals
- evidence packs and the verifier
- keeps deciding from cached policy
deciding policy v14 · 0 ms added by the control plane
policy flows down
counts and digests up
✕
Underwrit Cloud or self-hosted
Control plane
Fleet policy, organisations, witness.
- policy rollout across environments
- members and sign-in for the fleet
- independent witness and timestamps
- usage counts, never contents
Works with your stack
Plug it in where your agents already talk to the world.
A sidecar, the gateway you already run, or twenty lines of SDK.
- Gateways Envoy, Istio, Kong, agentgateway, LiteLLM, Portkey
- Agents MCP, OpenAI, Anthropic, Claude Code, LangGraph, ADK, Vercel AI, Restate, DBOS, Inngest
- People Console, Slack, Teams bot, phone push, passkeys, OIDC, SPIFFE
- Signals OpenTelemetry, Envoy response observer, 45 templates, 42 signed packs
Underwrit Gateway
MCP stdio, SSE, HTTPOpenAIAnthropic
API and mesh gateways
EnvoyEnvoy AI GatewayIstioagentgatewayKong
LLM gateways
LiteLLMPortkey
Your code
Claude CodeOpenAI Agents SDKLangGraphGoogle ADKVercel AI SDK
Approvals where people are
ConsoleSlackTeams cardsTeams bot previewPhone push
Identity for approvers
OpenID ConnectPasskeys (WebAuthn)SPIFFEbreak-glass
Durable workflows preview
RestateDBOSInngest
Agent payments
AP2 mandatesx402
Observability
OTLPEnvoy response observer
Policy to start from
45 templates42 signed packsCoding agents, MCP, Kubernetes, IAMPCI, HIPAA, DORA, SEC 17a-4
Agents from other companies
Agent passportsSPIFFE IDsEntra Agent ID
Insurers and regulators
Risk statement linksRegulator exports
New after 1.0 · 38 features
Approvals people sign. Policy you can prove. Records others can rely on.
Each one carries its plan. The free console shows the paid ones locked, never hidden. How each one works.
Approvals people sign
Live task workspaceIntended, authorized and observed side by side. The cluster enforces the contract.FreeTeam · task budget
Passkey-signed approvalsThe approver's device signs the exact action.FreeEnt · required per env
Approver attentionA review, or a rubber stamp? Time to decide, per person.Team
Answer in Teams or on your phoneThe Teams card carries the answer. Push for every hold.TeamTeams bot: preview
Durable workflowsA held step suspends in Restate, DBOS or Inngest.Freepreview
Review cardWhere each value came from, what changed, what nobody knows.Free
Approval drillsPlanted holds that never run, with consent. Was it caught?Ent
Policy you can prove
Policy packsSigned by the publisher, scored on your last 30 days first.Free · 21 packsTeam · 17 more, privateEnt · 4 more
Confidentiality classespublic · internal · confidential · regulated. Declassify on the record.Team
Adversarial rehearsalTonight's attacks, built from today's traffic.Team
Incident regressionsEvery incident becomes a case the next policy change must pass.Team
Policy proofsWhat the policy can never do, checked over every case.Ent
MCP server trustApproved servers, pinned definitions, a tool-poisoning scan.Free · scanTeam · allowlist
Package install guardInvented, brand-new and lookalike packages held.FreeTeam · feed
Injection testing on your trafficDid the agent fall for it, and did the gate catch it?TeamEnt · signed report
Adaptive campaignsAttacks tuned against your agent, scored on held-out material.TeamEnt · signed report
Records others rely on
Observed outcomesWhat the tool returned, beside what the agent said.Free
Certification check and badgeA signed check of this deployment against a profile.Free
Incident flight recorderTimeline and blast radius in one click. Signed bundle.Team
Regulator exportsEU AI Act Art. 12 and 73, SEC 17a-4, FINRA 4511, DORA.Ent
Audit-firm samplingStatistically sized samples, each with an inclusion proof.Ent
Execution coverageWhat the gate saw, checked against an independent audit log.FreeTeam · qualify, enforce
Connector certificationMatching tested on fixtures, withdrawn when the route changes.Team
Reliability targetsFailed, held and refused rates per agent, against a budget.Team
Replayable decisionsRe-run a past decision's gate and model call.Ent
Incident divergenceWhere a different policy would first have changed the outcome.Ent
EU AI Act technical fileClassification, obligations and the Annex IV file.Ent
Agents across companies
Agent passportsWho an agent acts for, and how it has behaved.Free · verify (MIT)Team · issue
Payment mandatesAP2 mandates and x402 requests checked before paying.Team
Authority rooted in a personA passkey grant that holds across company lines.Ent
Action clearingBoth companies' gates co-sign one record.Ent
Shared task budgetsOne limit across every session and sub-agent in a task.Team
Trust without trusting us
Insurer risk statementSigned, metadata only, shared by link.TeamEnt · daily feed
Public witness networkIndependent operators cosign, k of n.Free · enrolTeam · quorumpartner
Confidential gateCheckpoints attested by the enclave that made them.Entpreview
Underwrit WarrantyA claimed loss checked against the record: held, then run without approval?Entpartner
Memory lineage and repairRevoke a bad source; every memory from it is quarantined.TeamEnt · revoke
Provider consistency checksIs the model you pay for the one that answers?TeamEnt · cited per decision
Next
Hardware attestation for the confidential gateWitness operators and a Warranty carrierFree-text exfiltration, with a measured false-positive rateMCP gateway on the final stateless spec
Built after 1.0 and arriving with the next release. Adaptive campaigns, injection tests, replays and provider checks call your agent or model endpoint; those calls were tested against stand-ins. Preview: the Teams bot and the durable engines are tested against stand-ins of each service, and the confidential gate's attestation is simulated. Partner: the witness network needs independent operators, and Warranty cover needs a carrier; neither is offered yet. Export mappings are our reading of each text.
Get started
Three ways in, depending on who you are.
The product comes licensed. Checking a record or calling a plane is public and MIT.
Run Underwrit on your own machine
- Request the free edition below. We reply by email with access to the container image and your licence.
- Run the quickstart: a plane, a held action, two approvers and a verified pack in about a second, with no network. Then run the product, console included, on your own machine with one Compose file we send with it.
$
Request the free edition
docker run --rm ghcr.io/underwrit-io/underwrit:0.6.0 quickstartVerify a record someone gave you
Drop the pack on the browser verifier, where nothing is uploaded, or run the same checks from the public verifier repository with Python's standard library.
$
Open the browser verifier
git clone https://github.com/underwrit-io/verifier && python3 verifier/python/verify.py session.zipCall a plane from your agent
The Python client asks a data plane before each tool call, claims approvals and records outcomes. The TypeScript client is npm install underwrit-client.
$
See the integrations
pip install underwrit-client
Measured, 21 October 2026
We test our own claims, and publish the misses.
The suite ships with the product: python3 -m underwrit eval. Our own cases, so a floor, not an audit.
42/42
attacks stopped with the reference policy, across the OWASP agentic risks and data exfiltration.
15/16
honest look-alike actions allowed. The one hold: restarting a production pod, held as irreversible.
19/19
tampered evidence packs caught, including a deleted decision with the log key in the attacker's hands.
20/20
policy template checks pass. The suite found a real spend-limit bug, now fixed.
Pricing
Free for one team. Paid when you run a fleet.
Everything that decides, records and verifies is free for one environment and one team.
Free
Self-hosted$0forever
For one team putting its first agents in front of real tools. Self-hosted.
Request the free edition- 1 environment, 1 team
- Data plane, control plane, and every console page except Organisation
- Holds, two-person approvals, claims
- Signed record, evidence packs, offline verifier
- Auditor workspace and framework mapping
- Policy templates and the evaluation suite
- Underwrit Gateway and every integration
- Single sign-on with OpenID Connect
- Passkey-signed approvals, free policy packs
- Observed outcomes, certification badge, passport checks
- Review card, execution coverage, MCP scan, package guard
- Witness you run yourself
- Best-effort email support
Starter
Underwrit Cloud$99per month, or $990 a year
For one team taking its agents from staging to production. We host the control plane.
Start with Starter- Everything in Free
- Up to three environments for one team
- Fleet view and one policy across them
- Roles scoped to each environment
- Hosted control plane, members, sign-in by email link
- Hosted independent witness and RFC 3161 timestamps
- Email support
- Features marked Team stay locked
Team
Underwrit Cloud$490per month, or $4,900 a year
For a team whose agents run in many places and need the controls marked Team. We host the control plane.
Request a trial- Everything in Starter
- Any number of environments for your organisation
- Insurer risk statement and incident recorder
- Approvals in Teams and on your phone, approver attention
- Payment mandates, agent passports, classes, nightly rehearsal
- Task budgets, memory lineage, injection tests, adaptive campaigns, reliability targets
- Email support
Enterprise
Cloud or self-hostedfrom$4,000per month, billed yearly
For regulated companies with many teams. On Underwrit Cloud or self-hosted under a licence.
Talk to us- Everything in Team
- Several teams, environments set by licence
- SAML single sign-on and SCIM
- Audit-firm engagements across clients
- Support access you grant and can see
- Choice of region
- Keys you hold yourself
- Regulator exports and audit-firm sampling
- Policy proofs, authority rooted in a person, clearing across companies
- Continuous insurer feed, confidential gate (preview)
- Approval drills, incident divergence, decision replay, AI Act file
- Warranty claim packs; cover needs a carrier partner
- SLA and DPA
14-day Team trial, no card until it endsStartups under 25 people: half price on Team for the first yearCancel any time: your account turns read-only and you can still export every record
What "one environment" means, and what happens at two.
An environment is one data plane deployment, however many replicas it runs. The limit is checked only when a second team or environment is created. That request is refused with a link to the plans. Nothing already running is slowed, stopped or cut off.
In the free console you see every page, including Fleet, Keys and witnesses and the auditor workspace. Organisation needs a paid plan, and paid features on Assurance, Partners, Incidents and Policy lab show locked with what they do and a See plans link.
team · acme paymentsfree edition
production12,408 decisions todaydeciding
stagingPOST /v1/tokens · role node · for staging
402 · a second environment needs a licenceSee plans| Where the plans differ Prices in US dollars, before tax. | Free$0 | Starter$99 / month or $990 / year | Team$490 / month or $4,900 / year · 14-day trial | Enterprisefrom $4,000 / month, billed yearly |
|---|
Compare all features
| Every feature | Free$0 | Starter$99 / month | Team$490 / month | Enterprisefrom $4,000 / month |
|---|
✓ included · – not included. An environment is one data plane deployment with its own record, for example staging or production, however many replicas it runs. A team is one organisation's set of members and roles. A self-hosted install that reaches a second environment or team asks for a licence; what already runs keeps running. Paid self-hosted installs get a signed licence key, checked offline.
Questions
Plain answers.
What is Underwrit, in one sentence?
A checkpoint between your AI agents and the tools they use, which decides whether each action may run, gets the right people to approve the risky ones, and keeps a signed record that anyone can check.
Does it slow my agents down?
Routine actions are decided on your own data plane in milliseconds and go straight through. Only actions your policy holds wait, and they wait for a person, not for us. The hosted service is never in the path of a decision.
Does Underwrit Cloud see my data?
No. Arguments, sessions and the record stay on your data plane. The hosted control plane receives policy versions, usage counts and the size and root fingerprint of your log, which is what a witness needs. It has no place to store an argument.
What is free, exactly?
The data plane, control plane, console, gateway, integrations, policies, templates and evaluations, free for one environment and one team. The evidence format and the verifier are MIT licensed and public, so anyone can check a pack without our software. A second environment or team needs a paid plan, as do members, SAML and SCIM, and the hosted service. Of the features built after 1.0, these are free too: passkey-signed approvals, observed outcomes, free policy packs, durable-workflow adapters, enrolling in the witness network, checking agent passports and the certification badge. Nothing that is already running is cut off.
What does beta mean?
Underwrit works end to end today, and we are hardening it with early users before general availability. Expect changes before then. The evidence format is versioned, so packs you make during the beta stay verifiable with the public verifier.
Is Underwrit open source?
No. Underwrit is proprietary software under the Underwrit Software Licence, free to use for one team and one environment. What you need to check a record without us is public under the MIT licence: the evidence format, the verifiers and the client libraries, in github.com/underwrit-io/verifier.
How do I get the free edition?
Request it from the Get started section, or write to admin@underwrit.io. You get the package and a licence for one team and one environment. Install it on your own machine or cluster; nothing about your agents leaves it.
Does the free edition send anything to Underwrit?
Once a day, each plane sends a signed check-in: an install id, whether it is a data or control plane, its version and edition, the licence id and its limits, how many teams and environments it counts against them, and whether its build is the one we signed. A data plane also sends the install id of the control plane it takes policy from, and a digest of its node name (never the name, which is often a host name). Nothing about agents, decisions, arguments, policies, evidence or people. Set UNDERWRIT_CHECKIN=off to stop it; the licence then relies on an audit instead. The licence explains both.
What is not live yet among the new features?
Two need an outside partner: the public witness network has no independent operators yet, and Underwrit Warranty needs an insurance carrier, so cover is not offered. Three are previews: the Teams bot and the Restate, DBOS and Inngest adapters are tested against stand-ins of each service, and the confidential gate simulates attestation instead of checking a hardware vendor's chain. Regulator export and framework mappings are our reading; your counsel decides what is filed.
Can an insurer or another company check our record without our software?
Yes. A risk statement, an export, a certification result and an agent passport are each signed with your plane's key, and the public MIT verifiers check them offline. Issuing them depends on your plan; checking them never does.
Can I start by only monitoring?
Yes, and new environments do. Underwrit records what would require approval and what it would block, without blocking anything, and the console says so on every page where it matters, so you can read the report, tune the policy, and then switch enforcement on per environment.
Which paid plan do I need?
Starter if one team needs Free's features in more than one place, such as staging and production: up to three environments on Underwrit Cloud for $99 a month. Team when you need more environments than that, or the features marked Team, such as connector certification, incident regressions, PagerDuty and Jira routing, or a named sponsor per agent. Moving up keeps everything you have.
Is there a startup price?
Yes. Companies with fewer than 25 people pay half price for Team for the first year: $245 a month, or $2,450 for the year. Write to admin@underwrit.io from your company address.
What happens when a trial ends or I cancel?
Your account becomes read-only. Nothing is deleted, and you can still export every evidence pack. Your data planes keep deciding from their last policy.
Is this a certification for SOC 2 or the EU AI Act?
No. Underwrit gives your auditor evidence mapped to those frameworks and a workspace to test it. The auditor decides what is in scope and whether the evidence is enough.