Replace the approved transformer supplier on lot TR-7 with the alternative that lands nine days earlier at four percent more
- Your operation,
in balance - Evidence
Authority
Outcome
The approval layer for AI agents
Deploy AI automations safely
Set what agents may do, require approval for consequential actions, and keep the evidence.
Works with any MCP agentAuthority gatesEvidence ledger
Approval queue
Northwind DC-2 build, three actions waiting on a person
Calls today412
Held9
Refused2
Unlogged0
procurement-agent proposes
Needs reviewReplacement supplier on PO-4471
- Irreversible
- Spend
The proposed supplier differs from the approved purchase terms, and the change reaches the commissioning date.
- Reaches
- 7 records, 3 hops out
- Evidence
- Supplier quote and delivery terms
- Decision owner
- Procurement owner
Review proposed substitution
Nothing runs until a named person decides
In front of the agents and systems you already run
Any agent that speaks MCP, any system with an API, one ledger
Claude
OpenAI
LangChain
Cursor
Codex
GitHub
Salesforce
Microsoft
Azure
AWS
Slack
Atlassian
Twilio
Notion
Google Drive
Outlook
Zoom
Dropbox
Figma
Gmail
The threat model
Five ways an agent
gets a company into trouble
Five failure modes. Five controls outside the model. Open a control for the details.
- 01
Indirect prompt injection
A supplier PDF, a web page, or a ticket comment carries an instruction: raise the limit, approve it yourself.
The control
Authority lives outside the model
Effect labels come from the call and the policy, never from the conversation. Text an agent reads can change what it proposes, never what it may execute.
- Effect vocabulary
- Authority gates
- 02
Excessive agency
One broad token, and an agent asked to check a delivery date can amend the purchase order behind it.
The control
Grants are narrow and opaque
Each workspace holds credential references the agent cannot read, inside a sandbox that reaches only the records in its grant.
- Scoped credentials
- Sandboxed execution
- 03
An irreversible action nobody saw
Money moves, a specification is accepted, a record is deleted, and the first person to hear is whoever finds it.
The control
Consequence stops the call
Every call is labelled read, write, irreversible, or spend before it runs. Reads run. The rest stop at a gate bound to a named role, evidence and blast radius attached.
- Authority gates
- Decision Graph
- 04
A tool that changed underneath you
An MCP server is swapped, or a tool keeps its name and quietly starts doing something else.
The control
One way in, and it is pinned
Agents reach systems only through the gateway. Servers and tools are pinned per workspace, and a call outside the grant is refused rather than queued.
- MCP approval gateway
- Agent evaluation
- 05
No proof after the fact
Something happened last quarter. Nobody can say which agent did it, on what evidence, or who approved it.
The control
The record is the product
Proposal, source records, approver, and confirmed result as one decision record, exportable for audit and replayable as an evaluation case.
- Evidence ledger
- Agent evaluation
One tool call, end to end
What happens between
an agent and your systems
Tempera sits at the tool call, in front of any agent that speaks MCP. Every call is labelled, checked against the agent's grant, and allowed, held, or refused. Follow one from proposal to proof.
- 09:40:51procurement-agent
erp.quotes.listAllowed3 quotes returned - 09:41:03Claudeprocurement-agent
erp.purchase_orders.amendHeldAwaiting responsible engineer - 09:42:40logistics-agent
tms.bookings.rebookAllowedInside the sailing window - 09:44:38rack-agent
vendor_portal.orders.writeDeniedOutside the agent's grant
This call
PO-4471 amend, lot TR-7 to the substitute supplier, 4 percent above the approved terms
SAPPurchase ordersEffect
- Read
- Write
- Irreversible
- Spend
Reaches
- Busan yard
- Rotterdam site
- Sailing SW-3
- Commissioning, 14 Nov
Authority
Held for the responsible engineer. Evidence attached: three quotes, delivery terms, graph reach
Ledger
- 09:41:03Proposed by procurement-agent
- 09:41:03Held, irreversible and spend
- pendingAwaiting the responsible engineer
- pendingResult recorded on execution
A procurement agent asks to amend PO-4471 in SAP: swap transformer lot TR-7 for the substitute supplier.
One automation
One automation, ten calls,
one that waits
An automation is a chain of tool calls across your systems. Tempera lets the reads and in-scope writes run, stops the chain at the call that spends or cannot be undone, and records every call either way.
- 01Oracle
tms.shipments.statusreadAllowedSW-3 held. Customs query on the lot TR-7 certificate - 02Microsoft
dms.documents.searchreadAllowedCertificate of origin found, revision 2, signed 21 Sep - 03SAP
erp.deliveries.readreadAllowedRotterdam site needs the lot on site by 2 Nov - 04Oracle
tms.customs.submit_documentwriteAllowedRevision 2 filed with the broker, inside the grant - 05Oracle
tms.sailings.searchreadAllowedSW-4 departs in 3 days and arrives 1 Nov - 06Oracle
tms.bookings.rebookwritespendHeldRebook lot TR-7 to SW-4. Freight 14,200 above the approved booking - 07Oracle
tms.bookings.rebookwritespendPendingExecuted on approval. Booking SW-4-118 confirmed - 08SAP
erp.deliveries.updatewritePendingDelivery date moved to 1 Nov, float 9 days - 09Procore
site.receiving.schedulewritePendingRotterdam receiving window booked for 1 Nov - 10Slack
slack.chat.postwritePending#rotterdam-site told: lot TR-7 arrives 1 Nov on SW-4
Calls before the gate ran inside the grant. The amber call waited for a named person. Calls after it ran because that person approved.
The whole operation
Now run the whole operation
A data center build. Agents move cargo across the supplier network, one change waits at a gate with its evidence, and you decide.
- 14Automations
- 3Gates held
- 27Decisions today
- 1Denied
ConnectedSAPSalesforceOracleMicrosoftAzureSlackGitHub
02See what it touches
Evidence ledgerEvery request, record, approval, and outcome
- procurement-agentProposed substitution for TR-7. Gate held under spec-change policy.
- evidence-ledgerAttached quote, specification TR-7, and factory test record.
- decision-graphChange reaches Houston receiving, site build, and commissioning.
- logistics-agentSW-3 cleared Rotterdam customs. Houston ETA unchanged.
- compliance-agentDC-2 compliance file: 40 of 42 documents verified.
- sandboxrack-agent requested vendor portal write. Outside grant. Denied and logged.
- logistics-agentRK-2 departed Monterrey. Site receiving window confirmed.
- evaluationprocurement-agent passed 31 of 31 substitution cases.
procurement-agentGated31 of 31 cases- May
- Read quotes, propose substitutions
- May not
- Change a specification
logistics-agentRunning12 lots tracked- May
- Track lots, rebook inside the sailing window
- May not
- Accept a customs declaration
compliance-agentRunning40 of 42 verified- May
- Verify documents against source
- May not
- Edit the compliance file
rack-agentDenied1 request denied- May
- Read batch status, schedule receiving
- May not
- Write to vendor portals
evaluationRunning31 cases passed- May
- Replay traces, score cases
- May not
- Act on the operation
sandboxRunning1 write blocked- May
- Run agents inside their grant
- May not
- Reach outside the grant
Blast radius
See what a change touches
before it runs
Review the records a proposal reaches, the changes it makes, and the policy that stopped it.
Decision Graph
erp.purchase_orders.amendNeeds review
- 7 of 41records reached
- 3hops from the call
- 2dates move
- +4%on 1.2M
The call
Direct2
PO-4471
Line 3 supplier replaced, 1.20M becomes 1.25M
Alternative supplier
Moves from qualified to active on this line
One hop2
Transformer lot TR-7
Delivery 5 Nov instead of 14 Nov
Factory test record
New certificate required before acceptance
Two hops3
Phoenix DC-2 site build
Rack energisation pulls forward nine days
Compliance file
Two documents replaced, both re-signed
Committed recordCommissioning, 14 Nov
Date holds, float rises from 2 to 11 days
Committed record- Proposed by an automation
Replace the approved transformer supplier on lot TR-7 with the alternative that lands nine days earlier at four percent more
- Direct
- Purchase orderPO-4471Line 3 supplier replaced, 1.20M becomes 1.25M
- Vendor masterAlternative supplierMoves from qualified to active on this line
- One hop
- EquipmentTransformer lot TR-7Delivery 5 Nov instead of 14 Nov
- ComplianceFactory test recordNew certificate required before acceptance
- Two hops
- SchedulePhoenix DC-2 site buildRack energisation pulls forward nine days
- AuditCompliance fileTwo documents replaced, both re-signed
- MilestoneCommissioning, 14 NovDate holds, float rises from 2 to 11 days
34 records in the graph are not touched by this changeCommitted record the policy protects
If approved
The amendment runs inside the granted scope and the receipt lands in the ledger
- Cost
- 1.20M becomes 1.25M
- Commissioning
- Holds at 14 Nov, float 2 to 11 days
- Documents
- 2 certificates re-signed before acceptance
If held
Nothing is written to the purchase order while the gate holds
- Cost
- 1.20M unchanged
- Commissioning
- Holds at 14 Nov, float stays at 2 days
- Exposure
- Lot TR-7 keeps the 14 Nov delivery risk
- Policy that fired
- Specification and supplier changes require the responsible engineer
- Evidence attached
- Supplier quote, delivery terms, and the approved specification
- Decision owner
- Procurement owner
- Next step
- Review the substitution against the approved terms
The graph is built from your source records and updates as they change
Policy and posture
The boundary is a file, the proof is a record
A gate is written down and versioned with your code. Nothing runs against a setting somebody changed in a console and nobody remembers.
gate "specification-change" {when effect is irreversible or spendor graph.reaches "commissioning"hold for role "responsible engineer"attach quotes, delivery_terms, graph.reachnotify slack, email, phoneexpire after 24h then escalate "operations lead"record proposal, evidence, approver, result}
Reviewed like your code, and the only thing that can let a consequential call through
- Deployment
- Hosted, single tenant, or inside your own cloud account
- Identity
- Your identity provider through SSO and SCIM, so an approver is a named person
- Secrets
- Opaque references per workspace, rotated and revocable. The model never sees a secret
- Data
- Source records stay in your systems. The ledger keeps references, hashes, and the decision
- Egress
- An agent reaches only the servers and tools in its grant, through the gateway
- Retention
- Decision records kept for the period you set, exportable to your audit tooling
- Review
- Every trace replays as an evaluation case, so an agent change is tested before it ships
Sectors
What is included,
by sector
Same graph, gates, and ledger. Different sources, reviewers, and connected systems.
Industrial supply chains
Supply chain risk decisioning
Supplier qualification, multi-tier dependencies, procurement choices, and substitutions, each reviewed with the evidence, the blast radius, and the accountable owner in view.
Scope and connections
Included
- Supplier change and substitution review
- Multi-tier dependency graph from source records
- Procurement authority gates and spending limits
Connects to
ERP, procurement, supplier portals, document stores
Data centers
Equipment, delivery, and commissioning
Equipment availability and substitutions checked against specifications, delivery commitments, and commissioning dependencies before a change is accepted.
Scope and connections
Included
- Long lead equipment tracking against specification
- Substitution review with engineering sign-off
- Delivery commitment and commissioning dependency graph
Connects to
Project controls, vendor portals, engineering document systems
Compliance evidence
Determinations with evidence, across industries
Source documents, unresolved discrepancies, and approval responsibilities collected for a determination, with an export a regulator or auditor can follow.
Scope and connections
Industries
- Financial services
- Healthcare and life sciences
- Energy and utilities
- Manufacturing
- Logistics and trade
- Data centers and critical infrastructure
- Defense and aerospace
- Public sector
Included
- Evidence collection from source systems
- Discrepancy list with owner and status
- Determination record with reviewer and rationale
Connects to
Document management, GRC tools, ERP, email
Risk decisioning
Third party, operational, and concentration risk
Third party onboarding, concentration exposure, and operational risk decisions made on the graph of who depends on whom, with the approval chain recorded.
Scope and connections
Included
- Third party onboarding and periodic review
- Concentration and single-source exposure on the graph
- Risk acceptance with named owner and expiry
Connects to
GRC platforms, vendor management, ERP, identity providers
Manufacturing
Production continuity and quality
Material shortages, engineering changes, and quality holds reviewed with the affected orders, lines, and customers visible.
Scope and connections
Included
- Shortage and allocation decisions with customer impact
- Engineering change review across affected parts
- Quality hold evidence and release authority
Connects to
MES, PLM, quality systems, ERP
Maritime logistics
Shipment exceptions
Domestic and international shipment exceptions followed through terminal records, receiving documents, and delivery responsibilities.
Scope and connections
Included
- Exception detection from terminal and carrier records
- Delivery responsibility and demurrage exposure
- Receiving document reconciliation
Connects to
Carrier and terminal feeds, freight forwarders, TMS
Questions from evaluations
What buyers, security reviewers, and operations leads ask before a pilot.
Which systems does Tempera connect to?
ERP, procurement, PLM, MES, quality, GRC, document management, carrier and terminal feeds, identity providers, and email and calendar tools, through bounded connectors with opaque credential references. Systems that only expose a browser are handled by the agent browser with exact confirmation.
Which industries do you serve for compliance?
Financial services, healthcare and life sciences, energy and utilities, manufacturing, logistics and trade, data centers and critical infrastructure, defense and aerospace, and the public sector. The evidence model is the same; the sources, determinations, and export formats are configured per industry.
Is Tempera a chatbot?
No. Tempera runs governed automations with typed results. A conversation can start one, but the work itself is a record of what was requested, what evidence was gathered, who decided, and what happened.
Does Tempera take actions in our systems?
Only the actions your automation declares and your authority policy allows. Proposals are separated from execution, and a system-confirmed result is recorded separately from an attempted action.
How does an engagement start?
With one consequential decision your team makes today. We map the evidence, the authority, and the systems involved, agree the boundary, and run a bounded pilot before any live connection.
Start with one decision
Define your agent security boundary
Start with one decision and its source systems. Define these boundaries before connecting.
- 01
Agent access
The workspace, credentials, and resources an agent needs, kept separate from permission to act
- 02
Action authority
Which actions an agent may propose, which need review, and who can authorize execution
- 03
Evidence and evaluation
The decision records, evidence, and evaluation cases needed to review agent behavior
- 04
Deployment and security
Hosted, single-tenant, or on-premises, with tenancy and identity confirmed with Tempera
Prefer a call?
Book a 30 minute call with the team. We will ask about your business and what should come first.