Individual subscriptions and tools
People put agents on a company card and run them under a personal login. By the end of the week one is doing real work on real customer data, and nothing about it sits in a company system.
The rules foragents at work.
Elvar Mantle is the governance layer of Elvar. It sets the rules agents work inside, and carries the tracking, monitoring and record a company needs to run them in the open.
It’s difficult to keep track of every agent that acts in your company’s name
Vendor agents
The tools you already pay for arrive with agents inside them. Each acts on your data under rules you did not write, and keeps its own log of what it did.
Your own in-house agents / tools
The agents your own team builds are the hardest to see. They sit close to your systems and change as the code changes. What they record is whatever their author thought to log.
What Mantle does
See
Every agent at work, laid out by vendor, owner and access. Read from where the work happens and from the vendors’ own logs, so an agent is in view whether it is one you run or one that came with a vendor’s tool.
Approve
One standing approval for each class of agent: its scope, an expiry date and a named owner. New agents of that class start inside it, so the decision is made once, not before every run.
Check
A required check runs on every change. A change outside the approval fails the check, and the evidence stays with the failure, no matter whose agent wrote the change.
Stop
One press: new credentials are refused, and open changes fail the check. The rules an agent works inside end when you end them.
Prove
A record kept in order: each entry is tied to the one before it, so a rewrite cannot slip through. Heads are timestamped by a third party, and the verifier is open source, so anyone can run the check themselves.
Are you and your agents prepared for…
Audits and reviews ask for records, rules and evidence. Elvar keeps them in one place.
SOC 2 audits
Controls, access records and evidence gathered in one place.
Record changes shall not obscure previously recorded information.
ISO 27001
Policies and operational records kept where reviewers can find them.
GDPR and data protection
A record of what your agents accessed and what changed.
Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.
DORA operational resilience
Operational history for the systems your business depends on.
High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system.
EU AI Act
Agent activity and the rules it ran under, written down.
Internal audits
One record your own reviewers can work from.
Sufficient records shall be maintained to furnish evidence of activities affecting quality.
Vendor risk reviews
See what third-party agents do inside your systems.
Penetration testing
Change history and access trails for the systems in scope.
Preserve the records exclusively in a non-rewriteable, non-erasable format.
Work with us.
We are working with a small number of pilot companies on real work, and we are always glad to hear from teams putting agents to use. Tell us what you are trying to move.