Policy enforcement for Claude agents
Check every agent action against your policy before it runs. Block, allow, or hold for human review. Ship agents in regulated industries with confidence.
Shipping agents in regulated industries is hard
CTOs and compliance teams block deployments when there is no enforcement, no audit trail, and no path from manual review to autonomy.
No policy enforcement
Agents call tools with no rule check. One unchecked action can trigger a regulatory review.
Stuck in full-review mode
Every agent action requires a human. The business never captures the value of automation.
No audit trail
No dated record of what the agent was and was not allowed to do. Compliance teams block deployment.
How QuotaGate works
Policy is checked before the guarded tool action runs. The agent never acts outside its rule set.
Define policy
Write rules in a versioned policy file. Each rule names the tool, method, and conditions.
Check before execution
The SDK checks policy before a guarded tool action runs. No action escapes the rule set.
Allow, block, or hold for review
Each action gets a disposition: allow, block, or require human review before it proceeds.
Metadata-only audit events
Every evaluation emits a metadata-only event. No prompts, no responses, no user content stored.
Human oversight built in
When a rule requires human review, the action is held until a reviewer approves or rejects it. The agent does not proceed without a decision. Every review is recorded as an audit event.
Built for regulated industries
QuotaGate is designed for teams shipping Claude agents where policy enforcement is a requirement.
FinTech
Agent handles fraud alerts, AML triage, or loan pre-screening.
Financial regulators examine AI governance. Policy enforcement and a dated audit trail support that review.
LegalTech
Agent drafts documents, reviews contracts, or summarizes cases.
Bar rules require attorneys to supervise AI. A policy enforcement layer supports that supervision.
HR Tech
Agent screens candidates, answers policy questions, or manages onboarding.
Employment law makes automated decisions high-stakes. Policy rules enforce guardrails at the tool-call level.
What the product looks like
Illustrative mockups of planned features. All data shown is synthetic.
12,847
3.1%
−1.4 pp from prior period
89.2%
+4.3 pp from prior period
8 min
−3 min from prior period
30-day trust trajectory
Illustrative synthetic data. Not live customer evidence.
| Rule | Disposition |
|---|---|
| no_account_closure Agent may not close a customer account. | block |
| transfer_limit Transfers over $5,000 require human approval. | require human review |
| pii_redact Redact PII before external API calls. | block |
Version history
Illustrative synthetic data. Not live customer evidence.
Amount exceeds $5,000 threshold.
Credit limit change requires approval.
Account closure is blocked by policy.
External communication requires review.
Illustrative synthetic data. Not live customer evidence.
Audit event log
2026-11-10| Event | Time | Rule | Disposition |
|---|---|---|---|
| evt_a1b2c3 | 14:32:01 | transfer_limit | escalated |
| evt_d4e5f6 | 14:31:48 | no_account_closure | block |
| evt_g7h8i9 | 14:31:22 | — | pass |
| evt_j0k1l2 | 14:30:59 | — | pass |
| evt_m3n4o5 | 14:30:41 | pii_redact | block |
Compliance report preview
Oct 1 – Nov 10
12,847
398
3
This report describes system behavior. It makes no legal compliance claim. Evidence supports review; interpretation is the responsibility of your legal team.
Illustrative synthetic data. Not live customer evidence.
Current capability and planned features
What exists today in the SDK, and what is planned for the design partner pilot.
Current SDK capability
- Client-side TypeScript SDK
- Policy file with version and content hash
- Guarded tool execution — policy checked before the tool runs
- Human review hook — hold actions for approval
- Metadata-only audit events through a callback
- Asynchronous HMAC-signed webhook dispatch (in-memory queue, not durable)
Planned for design partner pilot
These features are not built and not available today.
- Hosted backend storage for audit events
- Production dashboard with trust trajectory chart
- PDF and CSV compliance report export
- Durable webhook delivery
Questions and limits
What data does QuotaGate store?
Metadata only: tool name, method, parameter names, rule ID, disposition, and timestamps. No prompts, responses, or user content.
Is this production-ready?
Not yet. The SDK exists as a client-side library. The hosted backend, dashboard, and compliance report export are planned for the design partner pilot.
Which models does QuotaGate support?
Claude (Anthropic) only. Multi-model support is not planned for Track B.
Does QuotaGate guarantee compliance?
No. QuotaGate enforces your policy rules and provides audit evidence. It does not make legal compliance claims. Your legal team interprets the evidence.
What happens if the webhook endpoint is down?
The SDK retries three times within 30 seconds. After the last failure, it logs a delivery failure event and continues. The agent is never blocked by a webhook.
Inquire about the design partner program
We are accepting a small number of design partners in FinTech, LegalTech, and HR Tech.