Control every action your AI agents take, and prove what happened.

AI agents now take actions for your business. Prompts can't keep them in check, and logs can't prove what happened.

Agents issue refunds, move money and change customer accounts. Rules written in a prompt can be ignored, or overridden by a cleverly worded message. And when something goes wrong, a log is written by the same system that made the mistake and can be changed afterwards, so it can't prove what really happened. These incidents show what happens without controls.

• Agents act before anyone can stop them.

  In April 2026, an AI coding agent deleted a company's production database and its backups in nine seconds, without asking first. The outage lasted more than 30 hours.

  With Tridris: the agent reaches the database through Tridris without its password, and a DROP or DELETE waits for a person.

  Source: ABC News (opens in a new tab)

• Support agents can be talked into anything.

  In 2026, attackers asked a major platform's AI support assistant to change the email on customer accounts, then took the accounts over. The assistant did not verify who was asking.

  With Tridris: an account email change always waits for a business approver, with the risk signals in front of them.

  Source: VentureBeat (opens in a new tab)

• Small actions add up fast.

  In 2026, a personal AI agent sent more than 500 messages to its user, his family and his contacts. At $250 a credit, a looping agent can give away $25,000 in a hundred actions.

  With Tridris: hourly, daily and per-customer limits stop a loop after a few actions, whether it is giving credits or calling a tool.

  Source: Chris Boyd's blog (opens in a new tab)

The business remains accountable. In 2024, a Canadian tribunal held Air Canada liable for incorrect information its chatbot gave a customer. Source: Moffatt v. Air Canada, 2024 BCCRT 149 (opens in a new tab)

Check. Trace. Seal.

Every action your agents take passes through the same three steps, before, during and after it runs.

1. 01 · Check, before an action runs

   Limits that hold, whatever the agent was told.

   Every action is checked against the limits and budgets you set for that agent. It runs, waits for an authorized person, or is blocked, with the reason in plain words.

   Book a live demo

   • Per-action limits, daily budgets, per-customer and hourly limits for each agent
   • Run, hold for approval or block, decided before money moves or data changes
   • A malfunctioning or manipulated agent cannot talk its way past a limit
   • Runaway loops hit a limit within seconds, and every attempt is recorded
   • Pause every agent, or one group, in one click. Every request is refused and recorded until you resume.

   

   

   Blocked80% discount · above the maximum

2. 02 · Trace, while an action runs

   Every action tied to an agent, a session and a person.

   Each action is linked to the agent that asked for it, the conversation it came from and the person who approved it. Approvers decide in the dashboard or from a link on their phone. Add a passkey, such as Face ID or a fingerprint, and the record proves exactly who approved.

   Book a live demo

   • Approvals from the dashboard or a phone, with optional passkeys that cannot be phished or replayed
   • Approvers see the reason an action was held and its risk signals
   • A full timeline for every action: requested, held, approved, completed
   • Reconciliation flags any action taken outside Tridris

   

   

   ApprovedJordan Lee · with a passkey

3. 03 · Seal, after an action completes

   Proof of what changed, not just a log entry.

   Each action is sealed into a verifiable record: signed by Tridris, countersigned by a separate sealing service with its own key, and linked to the record before it. About every 10 minutes, DigiCert, an outside timestamp authority, timestamps the latest records, so no one, not even Tridris, can change, delete or backdate a record without it showing. For every completed action, the record holds a fingerprint of the affected item before and after the change, and a further record confirms that your system shows the change.

   Book a live demo

   • Before-and-after proof of every change, confirmed against your system
   • Countersigned by a separate sealing service and timestamped by DigiCert
   • Evidence for a dispute, an audit, an insurance claim or the board
   • An offline verifier in every package: no login, no network, no access to our systems

   

   

   VerifiedAll records passed verification

• Checked offline.

  The verifier inside every package needs no login and no network.

• Before and after.

  The record shows what changed, and a separate record confirms it in your system.

• Shared selectively.

  Records hold fingerprints; you choose which details each reader sees.

• Timestamped by DigiCert.

  An outside authority timestamps the records, so no one, not even Tridris, can rewrite or backdate them without it showing.

Built on open standards

• Ed25519

  Digital signatures · IETF RFC 8032

• JSON Canonicalization

  The same record always signs the same way · IETF RFC 8785

• SHA-256

  Fingerprints and the record chain · NIST

• Passkeys

  Optional, phishing-resistant approvals · W3C WebAuthn, FIDO2

• RFC 3161 timestamps

  An outside time-stamping authority, DigiCert · IETF RFC 3161

• Open record format

  Designed by Tridris, so a record can be checked independently; specification on request

Live today

Built-in checks for six customer-support actions for online stores. Any other action you define, and any tool your agents use through MCP, gets the same Check, Trace and Seal.

• Refunds

  Per-refund limits, a shared daily budget and approval above your threshold.

• Store credit

  Small credits are counted together, so goodwill gestures cannot quietly add up.

• Order cancellations

  Orders already shipped cannot be cancelled; high-value cancellations wait for approval.

• Shipping address changes

  Changes to another region, or soon after an account's contact details changed, wait for approval.

• Account email changes

  Identity changes always need a business approver, with risk signals shown to them.

• Discount codes

  Small discounts go through; larger ones need approval; anything above your maximum is refused.

• Your own actions

  Define any other action your agents take, such as a vendor payout or an access grant. The same limits, approvals and records apply, and your own system runs it once Tridris clears it.

• Any MCP tool

  Agents reach their tools, such as a database or a deployment server, through Tridris. Each call is allowed, held for approval or blocked by your rules, and unknown tools are blocked. Tridris holds the credential, not the agent.

Using AI agents for other actions? Tell us which ones.

Start where you are comfortable

Most design partners start with Decision-only: your credentials stay in your systems.

Choose how much Tridris does for you, and move to the next step when you are ready. Every step uses the limits and approvals you set for each agent.

• 1. Simulate

  Give Tridris read-only access to your systems. See which of your agent's recent actions would have been held or blocked under your limits, and what they were worth. Nothing changes.

• 2. Decision only

  Your agent asks Tridris before each action. Cleared actions get a signed authorization, and your own system carries them out with your credentials. Tridris never holds credentials that move money, and every decision and result is sealed as a verifiable record.

• 3. Enforce

  Tridris checks each action, routes it for approval when needed and carries it out through your systems, so the agent never holds your credentials. Every step is sealed as a verifiable record.