Execution accountability for AI agents

Turn the agents on. Prove every action they take.

Someone has to sign off before an agent gets write access. Track makes that sign-off defensible.

Design a pilot

Same action. Different decision.

One request · byte-for-byte identical

ALLOWED

DENIED

A text classifier sees the same request twice. Track sees the authority behind it.

Same bytes · different authority · different decision · both outcomes signed, both re-checkable offline

Self-hosted — your cloud or on-prem Nothing leaves your environment Your signing keys Model and framework agnostic

The core engine

Posture and identity tools stop at who can act. Track decides, and proves, every time they do.

IdP

Cloud

CI / repos

MCP registry

14 agents named

Discover

Every agent and MCP server, built from systems you already trust — sourced, not guessed.

wire_transferALLOWED

wire_transferDENIED

Decide

Allow, deny, restrict, or escalate — on the authority behind the request, not its wording.

VERIFIED

Prove

What ran, bound to the approval — a signed receipt checkable with Track switched off.

Proof, not promises

A log asks you to trust the system. A receipt is built to be checked.

Every mediated action leaves a signed, offline-verifiable receipt — and the estate it acted in is counted, not guessed. See how it's built →

AGENT ACTION RECEIPT

VERIFIED

Decision

Tool & operationwire_transfer.execute

Policy & versionfinance/wire_transfers · v14

DecisionALLOW

Approver— (auto, under $10k threshold)

Signature

Signing identitytrack-enforcement-node-01 (Ed25519)

Chain positionentry #418,220 · prev sha256:e88b…3d15

Timestamp authorityRFC 3161 · DigiCertno stake in the answer

VERIFIED the verifier's verdict — not a field the receipt asserts about itself

{
  "schema": "track/agent-action-receipt/v1",
  "agent": "finance-agent",
  "tool": "wire_transfer.execute",
  "resource": { "account": "ACC-9931", "amount": "1.00", "destination": "account-A" },
  "requested_action_digest": "sha256:3f9a...e21c",
  "policy": "finance/wire_transfers",
  "policy_version": 14,
  "decision": "ALLOW",
  "executed_action_digest": "sha256:3f9a...e21c",
  "chain": { "entry": 418220, "prev": "sha256:e88b...3d15" },
  "timestamp_authority": { "standard": "rfc3161", "authority": "digicert" },
  "signing_identity": "track-enforcement-node-01",
  "signature_alg": "Ed25519",
  "signature": "ed25519:9d3c...12fa"
}

Requested, decided, executed — bound together, checkable by someone who doesn't trust us.

What's running

Where → reach

Source

Status

finance-agent

Prod VPC → payments API, ledger (write)

Cloud audit log + live traffic

GOVERNED

release-bot

CI → main branch, deploy pipeline

CI config + live traffic

GOVERNED

claude-code

14 laptops → 3 repos, staging DB

Endpoint scan (MCP config)

UNGOVERNED

mcp-server · internal-crm

Unregistered → CRM API, ~40k customers

Repo scan (.mcp.json)

UNGOVERNED

unmanaged devices

Personal laptops, outside MDM → unknown

None — we won't search a personal machine

Built from systems you already trust — a number you can't source is a number no auditor takes.

.mcp.json — one line per project, or one push through MDM

{
  "mcpServers": {
    "github": {
-     "url": "https://mcp.github.example/sse"
+     "url": "https://track.internal/mcp/github"
    }
  }
}

Same agent behavior. Every call now hits a decision point and leaves a receipt.

No SDK, no code change — turned on without touching the agent.

1 / 3