Everything from policy authoring to production audit.
Spctre covers the full agent governance workflow — write and review policies, enforce decisions at runtime, log every outcome, and export audit-ready records — without requiring you to change your framework, cloud, or model.
Author, review, and publish policies safely
Policy lifecycleBranch and revision history
Every policy change lives on a branch with authorship, diff, timestamp, rationale, and target workspace. Nothing is lost — you can inspect every revision and see exactly who changed what and why.
Reviewer sign-off before publish
Require approval before a policy goes live. Approval state, reviewer identity, rationale, escalation status, and SLA timing are all recorded as durable audit entries.
Versioned, hashed bundles
Org-level, workspace, environment, and connector policies compose into one versioned, hashed bundle targeted to specific runtimes — so you can prove exactly which policy was active at the time of any decision.
Pack import and catalog
Import connector packs, framework packs, enterprise baselines, and local overlays. Source, version, and compatibility metadata are preserved so you know where every rule came from.
Conflict detection before merge
Compare proposed rules against the active bundle before publishing. Spctre surfaces conflicts and identifies the exact pack, branch, rule, and reviewer path involved.
Publish gates that don't fail silently
Block publish when required reviews, simulations, branch checks, or compliance conditions are missing — and produce an audit log for each blocked attempt so there's a record of what was missing and when.
Audit logs auditors can actually use
ImmutableDecision log ingestion
Capture every ALLOW, DENY, and REVIEW with connector, action, agent identity, policy references, artifact hash, environment, and runtime target — from any framework or cloud.
One unified operations record
Gateway decisions, tool calls, human approvals, policy bundle hashes, and runtime targets are linked into a single inspectable ledger — not scattered across separate log sources.
Tamper-evident hash chain
Audit ledgers are maintained with hash-chain integrity. Verification checks detect unexpected changes to historical records, so you can trust what the log says.
Retention and redaction controls
Configure retention windows by workspace and connector. Redact sensitive values before the record is written — preserving the structural log and provenance without retaining the sensitive content.
Ledger verification
Confirm ledger continuity, hash-chain integrity, expected policy references, and audit shape before export or incident review — so you're not discovering problems during an audit.
Searchable provenance
Query by agent, connector, action, environment, decision status, policy reference, reviewer, workspace, runtime target, or artifact hash. Find any decision in seconds.
Test policy changes before they reach production
Simulation & complianceSimulate against real history
Run proposed policy changes against past production events and see exactly which decisions would flip — before the policy is published and before any agent is affected.
Impact analysis by connector and environment
See which workflows a new policy would block, approve, or escalate, broken down by connector, workspace, environment, and runtime target.
Compliance export packets
Generate structured packets for security reviews, customer incident responses, and regulatory inquiries — including policy references, artifact hashes, reviewer chain, timestamps, and decision records.
Multi-framework audit mapping
Organize audit logs for SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, NIST AI RMF, and public-sector review. The same records serve multiple frameworks without duplicating governance work.
Baseline drift detection
Compare active policies against expected baselines and surface changed controls, missing approvals, stale bundles, and connector-specific drift before they become a compliance finding.
Exportable review trails
Reviewer chain, decision rationale, timestamps, branch revisions, simulation outcome, and publish gate state are all preserved in a format an auditor can inspect without direct system access.
Enforce decisions at runtime — or observe first
Gateway & enforcementLow-latency decision gateway
Evaluate agent actions against your active policy bundle in real time. Returns ALLOW, DENY, or REVIEW with policy references, trace IDs, and latency telemetry — designed to sit inline without adding meaningful delay.
Human review before an agent acts
REVIEW decisions pause the workflow and route the action to a named approver. The approver sees full decision context, approves or rejects, and the outcome — including their identity and rationale — is recorded in the ledger.
Per-agent trust and context budgets
Track trust scores and context budget consumption per agent across sessions. Violations surface as governance events with full ledger provenance, so you know which agent crossed which threshold and when.
Observe mode — no blocking
Record governance decisions without halting runtime behavior. Use observed audit logs to tune policies and build confidence before switching to enforcement.
Enforce mode — full control
Block denied actions, route review actions to approvers, and return decision metadata to the calling runtime. Move individual agents from observe to enforce independently, at your own pace.
Scoped credentials for long-running agents
Support device authorization, refresh token rotation, service account keys, and scoped credentials — so agents can run continuously without requiring overly broad permissions.
Security and enterprise controls
Tenant · Identity · DataFull tenant isolation
Policies, audit logs, identities, service accounts, and workspaces are all scoped to tenant boundaries. No cross-tenant access is possible at the query or storage layer.
SAML, OIDC, and RBAC
Connect your identity provider, enforce MFA, configure role-based access, and manage members and administrative review workflows from one place.
Payload capture is opt-in
Spctre captures decision context — agent, connector, action, policy match, outcome — without storing action payload data unless you explicitly configure it. Sensitive values can be redacted at the gateway before any record is written.
Credential governance
Manage API tokens, service keys, refresh flows, revocation events, and scoped access for automation and agent runtimes — with audit records for every credential lifecycle event.
Alerts routed to your channels
Route review queues, policy drift, suspicious decisions, gateway failures, and compliance events to the channels your team already monitors — Slack, PagerDuty, email, or webhook.
Private and custom deployment
Run Spctre in managed cloud, deploy privately into your own infrastructure, or use local and custom adapter patterns for strict data residency or air-gapped requirements.
Works with the stack you already run
Stack-neutralPut governance in place before your agents go further.