Avowex is proof of approval for AI agents. Before an agent takes a risky action (like a refund, outbound message, or data change), a named person approves, edits, or rejects it, and the decision is sealed into a hash-chained, tamper-evident record you can export and hand to an auditor.

How do I prove who approved an AI agent's action?

Record each approval at the moment it happens, with the named approver, the exact action, the time and the reason, in a log that is tamper-evident (for example hash-chained) so later edits are detectable. Avowex does this automatically: every escalation and decision becomes a verifiable receipt you can export as audit evidence.

How do I add human approval to an AI agent?

Call the Avowex API (or use the @avowex/mcp server or the Python/TypeScript SDK) to escalate a proposed action. A human reviewer approves, rejects, or edits it, then your agent resumes. It is one API call to wrap any risky action.

Does Avowex provide an audit trail for AI agents?

Yes. Every escalation and decision is written to a hash-chained, tamper-evident audit log you can verify and hand to an auditor as evidence of human oversight and logging.

Avowex has a free tier covering 500 resolved actions per month. Paid Business and Enterprise plans add higher volume, SSO, and data residency.

Does Avowex help with EU AI Act compliance?

Avowex provides the human-oversight checkpoint and the immutable logging that high-risk AI obligations such as EU AI Act Article 14 (human oversight) and Article 12 (record-keeping) call for, and supports SOC 2 logging requirements.

Proof of approval for AI agents

Your AI agent just did something.
Can you prove who approved it?

When an agent issues a refund, sends an email, or changes your data, Avowex puts a named person on the decision and seals it into a tamper-evident record. When a customer, an auditor or an insurer asks “who said yes?”, you have the answer.

Start free — 500 actions/mo See a receipt

No card. Python, TypeScript, or any MCP client.

What you get

Here’s what the proof looks like.

Each risky action your agent takes comes with a record that answers the only questions that matter after the fact:

What the agent wanted to do, with the exact details
Who approved, edited or rejected it: a named person, not “the system”
When and why, timestamped with their reason
Proof it hasn’t been changed since: every record is hash-chained to the one before it, so any edit shows up

Export it, verify it, hand it to an auditor. That’s the product.

Avowex receiptExample

ActionRefund $2,400 to customer #8812

Requested bysupport-agent-v3

DecisionApproved

Approved byDana Ruiz · Finance

Reason“Duplicate charge confirmed in Stripe”

TimeOct 9, 2026 · 10:42:07 PT

Record#4,812 · 9f3a…c21e

✓ Chain verified: unchanged since it was sealed

Agents act. Then someone asks who allowed it.

Most teams already have some kind of approval step. Almost none can prove it. Here’s what “proof” usually looks like today:

💬

A Slack thread

Someone gave it a thumbs-up. Hard to find later, and impossible to show it wasn’t edited or deleted.

📄

An app log

Written by the same system that took the action, and changeable by anyone with database access.

🤖

“The model decided”

Auto-approval is great at catching bad actions. It can’t be accountable for one. Auditors and courts want a person.

How it works

Your agent asks

Before a risky action, the agent calls Avowex and pauses. Nothing happens yet.

A named person decides

Your own approvers, from a secure link, or Avowex’s reviewers. Approve, edit or reject.

The receipt is sealed

The decision is chained into your audit trail, and the agent carries on with the verdict.

See every agent, rule and approval, live.

The Avowex dashboard watches the rules you set and what your agents do under them, and tells you what needs attention.

One score for controlA single 0–100 read on rules, accountability, agent behaviour and evidence.

Live agent mapWatch every action pass the checkpoint, including handoffs to partner agents.

Decide in one clickApprove, edit or reject from the dashboard. Agents can never approve their own requests.

Proof on demandReplay any day, open any receipt, and have the chain re-verified on the spot.

Open the sample dashboard →

Set up in minutes, with help built in.

A checklist that ticks itself off as you go, and Vanessa, our AI help desk agent, on every page of the console.

Guided setup. Each step checks your real workspace (your first action type, first decision, safe timeouts, approvers) and shows the exact code for what's next.

From first escalation to production-safe in one checklist
Flags risky settings, like timeouts that would approve with no one deciding
If Vanessa can't solve it, a person picks it up, with the full conversation attached, and you get a ticket number by email
Your whole team signs in with a one-time email link, no passwords or keys to share: admins, approvers who decide, and read-only viewers

Vanessa knows your setup. Ask about the SDKs, rules, the dashboard, audit evidence or billing. Try her now →

Two ways in

Building an agent

Add it in one call.

Wrap the risky action. Avowex handles routing, the decision and the receipt.

pip install avowex

from avowex import Avowex
avx = Avowex(api_key="avx_live_…")
esc = avx.escalate(
  action_type="issue_refund",
  context={"customer": "8812", "amount": 2400},
  idempotency_key="refund-8812-001",
  recommendation="Refund $2,400 to #8812",
)
decision = avx.wait_for_decision(esc.id)
if decision.approved:
    issue_refund(decision.payload or {"amount": 2400})

Start free

Also: npm install @avowex/sdk · npx @avowex/mcp

Already built your own approvals?

Keep them. Make them provable.

Built your own approval step in Slack or your app? Don’t rip it out. Avowex Record takes the decisions you already make and turns them into the same sealed, auditor-ready receipts. One call, nothing to re-architect.

Early access. We’re onboarding the first teams by hand.

For AI & security teams

Your agents are talking to each other. Who approved what they agreed to?

In OpenAI’s 2026 security-research runs, agents that were never given a way to communicate built one anyway, coordinated, and went on to attack Hugging Face. Then some of them spoofed their own tool-call records.

~1,200

agents used an unintended message board to coordinate

70,000+

messages and files exchanged between agents

transcripts with clear evidence of spoofed tool calls

🤝

Approve the handoff

A named person signs off before work, data or authority passes from one agent to another, including to a partner’s agent.

🔁

Stop permission shopping

When one agent is refused, asking a different agent shouldn’t get the same thing done. The refusal should follow the action. Early access.

🧾

Receipts agents can’t edit

Every handoff request and decision is sealed on Avowex’s side, outside the agents’ environment, so their own logs aren’t your only record.

Sources: METR independent investigation, Aug 26, 2026 · OpenAI, Aug 26, 2026. Research models with safeguards deliberately reduced. Handoff gating works today through the Avowex API; native A2A and gateway enforcement are in early access.

Read the technical guide → Get early access

Auto-approval is getting better. Accountability isn’t automatic.

Classifiers now catch more dangerous actions than people do, so use one. But when something still goes wrong, “a model approved it” isn’t an answer an auditor, an insurer or a court accepts. Avowex works with your classifier: let it clear the routine, and put a named, provable person on the actions that matter.

“While we believe auto mode reduces risk for most users, it relies on classification systems and therefore does not eliminate risk. For high-stakes changes to production infrastructure, we still recommend reviewing Claude’s actions yourself.”

Anthropic, on Claude Code auto mode — August 2026

Research

We let 7 AI agent frameworks run unsupervised.

Real frameworks on GPT-4.1, a fake $1,000 budget, no human in the loop. They were more careful than expected, and still took actions no one approved.

This is no longer hypothetical: in July 2026, a frontier model escaped its test sandbox and took ~17,000 unauthorized actions across another company's production systems in under two days. The runs that go wrong are the ones nobody approved.

7 / 7

scored Grade A — cautious by default

unsafe actions slipped through, unsupervised

$2,000 → $0

unauthorized spend, with one approval gate

Unsafe agent actions: unsupervised vs. with one approval gate

Read the full study → See a live demo →

Briefing · September 2026

Detection got better this month. Accountability didn’t.

Three frontier labs shipped stronger misuse detection in two days. The EU’s incident-reporting regime got its first real test. And a survey put a number on the gap underneath both.

53%

of security leaders have personally suppressed or withheld an AI incident report

31%

don’t know whether an AI breach has occurred in their organization at all

1 in 8

reported AI breaches now involves agentic systems specifically

HiddenLayer 2026 AI Threat Landscape survey (n=250), cited in the Cloud Security Alliance AI Safety Initiative research note, Sept 6, 2026.

“Right now, most of the laws we have on the books only require a plain-language summary of incidents like this, and they don’t give any authority for the governments to ask follow-up questions, to send in investigators, to have access to records, or require that they be preserved.”

Mackenzie Arnold, LawAI, to TechCrunch — Sept 4, 2026

When no one can compel the provider’s records, the only record that exists in an audit, a claim or a court is the one you kept — and it can’t be written after the fact.

Read the September briefing →

Who will ask

Someone is going to ask for proof.

Agents that take real actions are now a compliance and liability question. Audit trails can’t be backfilled, so the receipt has to exist before anyone asks for it.

🏢

Your enterprise customers

Security questionnaires now ask how you control and evidence what your AI agents do.

🛡️

SOC 2 auditors

Change authorization and logging controls: who approved it, and a trail that can’t be quietly edited.

⚖️

EU AI Act

Article 14 human oversight and Article 12 record-keeping. High-risk obligations apply from Dec 2, 2027.

📑

Insurers & courts

After an incident, the first question is who authorized the action, and whether you can show it.

See the framework-by-framework compliance matrix →

Get the compliance & benchmark data pack

The full methodology, the per-framework results, and how the audit trail maps to your controls — plus a 90-second platform demo.

Watch the demo + get the pack →

Designed to support SOC 2 logging and EU AI Act Articles 12 & 14. Avowex helps you produce the evidence — it is not itself a certification. Not legal advice; confirm your system's classification with counsel.

Simple, usage-based pricing

Start free, no card. Pay for what you resolve as you grow. Upgrade when you need approvers, automation, or compliance.

Free

$0/mo

Evaluate and prototype. No credit card.

500 resolutions / month
Mode B (reviewer pool), single review
Full Python & TypeScript SDK
Hash-chained audit log
Mode A, consensus, automation
Domains, reporting, SSO

Start free

Business

$99/mo + usage

For teams putting agents into production. ~$1.50 / resolution, less when auto-resolved.

Unlimited volume, metered overage
Mode A approvers + consensus
The flywheel: auto-resolve & training
Domains, reporting, batch verify
Scoped API keys & audit export
SSO/SCIM, single-tenant

Start building

Enterprise

Custom

For regulated & at-scale teams.

Everything in Business
SSO/SAML, SCIM, advanced RBAC
Signed audit attestation
Single-tenant / VPC & data residency
SLAs, SOC 2, dedicated support

Talk to us

Your AI agent just did something.
Can you prove who approved it?

Here’s what the proof looks like.