Execution evidence and guardrails for AI agents
Before execution, deterministic guardrails parse the operation itself and return a verdict in single-digit milliseconds. After it, the operation joins a hash-chained, signed, timestamped evidence stream you can verify offline.
Read-only deployment in thirty seconds: the Recorder observes, interrupts nothing, and produces your Exposure Report after thirty days.
The open standards the evidence rests on
AGENTS NO LONGER SUGGEST, THEY EXECUTE
No record that holds up when it is challenged
No deterministic brake before execution
And a regulatory deadline already on the calendar
A sealed device that records what was done and enforces the operating limits while the vehicle is moving. Sealr applies that principle to the operations your agents run against production systems.
The evidence is tamper-evident, not tamper-proof: it establishes the integrity, ordering, timing and origin of the recorded stream, without demonstrating that an unrecorded event did not happen. Coverage is a property of your deployment.
Every operation, sealed into a hash-chained, signed stream.
| Time | Subject | Integration | Operation | Resource | Verdict |
|---|---|---|---|---|---|
| 14:02:11 | agent-ops | sql | DELETE FROM users | db:prod-main | BLOCK |
| 14:01:47 | agent-deploy | terraform | apply · 3 destroy | aws:prod-eu-west | REQUIRE_APPROVAL |
| 13:58:02 | agent-code | git | push --force main | repo:platform/api | BLOCK |
| 13:57:30 | agent-analytics | sql | SELECT … LIMIT 500 | db:warehouse | ALLOW |
| 13:55:12 | agent-ops | sql | UPDATE orders SET … | db:prod-main | WARN |
Evidence is tamper-evident, not tamper-proof: it attests to the integrity, ordering and origin of what was recorded. Coverage is a deployment property.
Sealr records and constrains what your AI agents actually execute against production systems. The Recorder, a small Rust binary, sits where the operations pass: MCP proxy, agent hooks, CLI wrapper, GitHub App. Every intercepted operation becomes a signed, hash-chained record; before execution, the guards parse the operation itself and return a verdict. What is not intercepted is not recorded: coverage is a property of your deployment.
MCP stdio and HTTP proxy, Claude Code hooks, CLI wrapper, GitHub App
SQL Guard (PostgreSQL grammar), Terraform Guard (plan JSON), Git Guard
BLAKE3 chaining, Ed25519 checkpoints, RFC 3161 anchoring, daily eIDAS qualified timestamps
Signed YAML policies, Slack approvals, Exposure Report in PDF/JSON, .seal bundle
A DELETE with no WHERE, a Terraform plan that destroys, a force-push to a protected branch: the verdict lands before execution.
No change to your agents. MCP proxy, hooks, or CLI wrapper, observe mode by default, a few milliseconds added.
The verdict is returned locally, with no network call; only an approval request waits on a human decision. With no verdict, the operation proceeds and the coverage gap is recorded.
A signed, hash-chained, timestamped stream, exportable as an .seal bundle for an audit, a regulator, or a dispute. What is not recorded stays outside the stream.
Business impact
Every agent operation becomes a signed, hash-chained, timestamped record
What the AI Act, Directive (EU) 2024/2853, NIS2, and DORA concretely require you to produce when an AI agent acts on your production systems — and on what deadlines.
Read the analysisThe verifier and the evidence format are open, and the infrastructure stays European. What Sealr produces is tamper-evident, not tamper-proof: the evidence establishes the integrity, ordering, timing, and origin of the recorded stream, and does not prove that an unrecorded event did not happen. Coverage is a property of your deployment.