Infrastructure for agents that act on real systems.
Authorization, auditable execution, MCP validation and observability for AI agents, so you can prove what an agent did, under whose authority, and whether the outcome actually happened.
The problem
Your agent said it finished. Did it?
A successful model response isn’t the same as a successful business outcome. Tracing tells you what the agent attempted. It doesn’t tell you what changed.
- An agent can complete a run while the payment failed.
- It can report that a record was updated when the destination system never changed.
- It can call the correct tool with the wrong authority.
- It can finish a workflow while violating the policy that should have governed it.
- 1Agent request
- 2Model decision
- 3Tool action
- 4System change
- 5Outcome evidence
- 6Verified outcome
Capabilities
Six controls between an agent and your production systems.
Each one carries its real status and links to the matching view in the console preview below. Nothing here is shipping to general availability yet.
Agent authorization and permissions
Design-partner developmentEvery agent gets its own identity, scoped credentials and a record of who it acts for.
Actions above a threshold route to a named human approver, with an expiry.
Auditable execution
Design-partner developmentEach run produces a record built to be read later by someone who was not in the room.
Actor, credential, policy decision, tool call, response, outcome source, verdict.
MCP security and conformance
LiveModel Context Protocol servers are checked for conformance and unsafe tool descriptions before agents rely on them.
Built on the open-source MCP Conformance Scanner from ARC Labs, which you can run today without us.
Agent observability
In development · not publicSee what agents attempted, how long each step took, and which outcomes were verified, failed or unknown.
An unverifiable outcome is reported as unverifiable, never as success.
Agent governance and policy
In development · not publicWrite policy once and apply it to agents, tools and arguments, with monitor mode before enforcement.
Policy hits and blocks are counted, so you can tune before you enforce.
Infrastructure reliability
ResearchOne inventory of every agent, including the ones vendors switched on inside software you already pay for, and the health of the control plane itself.
Coverage and verification rates by owner, for the people accountable for them.
Console preview
Explore the console with a fictional company.
Northwind Demo Co. runs six agents. Click through what they can reach, what they did, and what the evidence says. Nothing here is connected to a real system.
Agent inventory
Every agent with an identity in this environment, including vendor-embedded ones.
| Agent | Risk | State | Runs 24h | Verified |
|---|---|---|---|---|
| high | active | 1,284 | 97% | |
| medium | review | 806 | 61% | |
| low | active | 4,120 | 99% | |
| high | review | 94 | 72% | |
| medium | active | 212 | 44% | |
| low | paused | 0 | — |
Preview only. Agent names, events, policies and findings are invented to show how ARC Control is intended to work. Capabilities may change during design-partner development.
See it
The operator console, as it actually renders.
Fifteen sections against a running control plane: what needs a human, what every agent attempted, which policy decided and why, whether the record still verifies, and what the nine governance controls could and could not establish about all of it. This is the console's own output, captured page by page from the running server — not a mock-up.
What you are looking at
- Real
- The policy decisions and their rule-by-rule traces, an approval that was cast and consumed, the evidence records, the hash-chained audit log those records verify against, and the nine control assessments evaluated over them.
- Simulated
- The connector effects. No money moves and no issue is filed — the same way the shipped demo seed behaves for anyone running it locally.
- Inert
- Anything that would write. Approve, reject, suspend and scan are rendered and disabled, each saying what it does in the live console.
- Not green
- Three controls report not assessable or attested rather than passing, and that is the product working. A control the platform cannot decide from its own records says so — reporting it green would convert an unexamined risk into a documented assurance.
Captured from revision 648998d · 123 pages
- OverviewWhat needs a human, ordered by consequence
- ApprovalsThe request, the policy that held it, the authority required
- ActivityEvery action that reached the gateway, and what governed it
- AgentsWho is authorized, and what they have attempted
- ToolsWhat may be asked for, at what risk
- PoliciesEach policy as a decision ladder
- AccessWhich policies govern which agent and tool
- AssuranceNine controls, and what each one does not establish
- RisksInherent, and the residual a named human reviewed
- FindingsWhat failed, against which subject, and how often
- SecurityConnector posture and an MCP manifest scan
- EvidenceOne record per attempt, with its integrity digests
- AuditThe chain, and what verifying it does not prove
- ReportsA snapshot over a window it always states
- SettingsWhat this deployment does, and what it cannot yet prove
ARC Control is in design-partner development. The console is real and running, and the assurance layer reports honestly on what it cannot establish — including that operator identity is not yet authenticated, which the Settings page states in those words.
Architecture
Nine points where agents need infrastructure, not just a model.
ARC Control focuses on the four highlighted points. The others are where our solutions work and the ARC Labs scanners usually come in.
Step 4 of 9 · ARC Control
Permission
Resolve what this identity is allowed to do right now, including the actions that need a human.
What ARC Control is not.
Security and platform teams have heard every claim. Here is what we don’t claim.
It is not available for purchase. Design-partner conversations only.
It is not a model-evaluation product and does not score answer quality.
It cannot verify an outcome in a system it has no read access to — the evidence has to come from somewhere.
It is not a compliance certification. It produces the evidence; your auditor draws the conclusion.
Running agents against production systems?
We are working through the verification model with a small number of teams. If your agents touch payments, records, infrastructure or customers, we would like to hear what breaks.
A person reads every inquiry, usually replying within two business days.