Every agent action, authorized.
AI agents now read company data, run code and change systems. 48Forge checks each consequential action before it runs, and audits your agents against your policy.
See it, decide it, own it, prove it.
Discover and monitor
Find every AI app, model API, agent, MCP server and tool, with one activity timeline per agent.
- Inventory of agents, tools, identities and sensitive data flows
- Coverage report: how much agent traffic passes an enforcement point
Authorize and enforce
Allow, deny, redact or ask for approval on prompts, data transfers and tool calls, at a point that can stop them.
- Signed decision record for every action
- Approvals in Slack or Teams, showing the exact action
Govern identities and access
Every agent gets an owner, a declared purpose and least-privilege access, with short-lived credentials where supported.
- Delegation and agent-to-agent chains tracked
- Permission drift: granted vs used vs declared purpose
Investigate and contain
Reconstruct what happened, why each decision was made and what ran. Revoke credentials or suspend an agent through your existing tools.
- Incident replay with time to containment
- Emergency suspension of an agent
We govern the action, not the prompt.
We ask whether this agent, acting for this person, may do this to this resource, with this data, right now, and we answer before it runs.
| Tier | Examples | Default decision |
|---|---|---|
| 0 · Read public | Web search, public documentation | Allow and log |
| 1 · Read internal | CRM lookup, repository read, SharePoint search | Allow within scope; data-loss checks on what leaves |
| 2 · Write, reversible | Draft an email, open a pull request, create a ticket | Allow within scope, with rate limits |
| 3 · Write, consequential | Send external email, merge to main, change access rights, change production settings | Human approval or a pre-approved runbook |
| 4 · Irreversible or financial | Payments, deletions, data export, creating credentials | Deny by default; named approver plus a second factor |
- The 48Forge browser: AI apps and browser agents used by staff
- The tool-call gateway: every tool call, API request and MCP call from an agent
- The credential broker: short-lived, scoped tokens that only work through the gateway
Taint tracking stops prompt injection
Once an agent reads untrusted content, such as a web page, an inbound email or an outside file, it may be following someone else's instructions. We mark that session at that moment, and its consequential actions need approval.
policy: finance-agents agent: owner_group: finance-ops, purpose: invoice-reconciliation allow_tools: [erp.read_invoice, erp.match_payment, email.draft] deny_tools: [erp.create_vendor, bank.*] rules: - when: tier 3 and tainted # read outside content then: require_approval(finance-lead) - when: confidential data to an external destination then: deny mode: enforce
Know your exposure before you act.
A read-only audit of the AI agents and tools in your organisation, with a ranked list of risks and clear next steps for the board and regulators.
- Read-only: nothing in your environment is changed
- An inventory of agents, owners, tools and permissions
- Risks ranked by consequence, not by count
- A short report mapped to the EU AI Act, NIS2 and DORA
Signed decision records
Every decision is hash-chained and signed, so any edit or deletion shows.
Execution matching
Each record is matched to what actually ran, and anything without a record raises an alert.
Daily control tests
Known-bad actions are replayed against your live policy in safe mode.
Fail-closed by default
If the policy engine cannot be reached, consequential actions stop.
Watch a data leak get stopped.
In a short demo with a founder, we onboard a contractor, block a risky download and mask personal data, live.
- Built in Poland, hosted in the EU
- Works with the apps you already use
- Every decision logged