An enclave for your agents. A harness around every turn.
Each workload runs in an isolated, hardened enclave connected to your own application. Six control layers sit on every turn, and the whole thing is observable end to end.
From shadow agents to a governed fleet.
Find what connected sources reveal, evaluate the workload, connect or provision supported agents, apply controls, then operate. You do not have to replace agents that already work.
Discover
Surface the agents and MCP servers visible through connected sources, including the ones nobody registered.
Connect or provision
Bring supported agents under governance, or stand up hardened ones from the catalog, each in its own enclave.
Govern
Bind each enclave to a policy and the framework packs it has to answer to.
Operate
Watch them live, trip breakers on drift or spend, and re-score posture continuously.
Every agent in connected sources, inventoried and owned.
Tovel scans the sources you connect, repositories, cloud accounts and CI/CD, for anything acting like an agent: scheduled scripts, MCP servers, copilots and autonomous jobs. Each is inventoried with its identity, its reach and its owner. Where AWS Agent Registry is enabled, Tovel reads from it.
Shadow agents with no owner, no policy and standing credentials surface first. Anything outside a connected source stays invisible until you connect it; the inventory shows which sources are in scope.
Stand up hardened agents and MCPs from a catalog.
Deploy from a catalog of hardened agent and MCP templates. Each is pre-scoped to least privilege, bound to a trust tier, and placed in its own enclave with a cryptographic identity and a named owner.
Connectors for repositories, cloud accounts, CI/CD and knowledge bases attach through the same vetted catalog, so nothing joins an enclave without review.
An isolated workspace, wired to your stack.
An enclave is where a small team of role-scoped agents operates on one of your applications, its repository, cloud account, CI/CD and MCP tools, under a single governance policy. On governed paths, policy decides what crosses the boundary. Per-enclave egress limits and network recording are in build.
Every agent carries a cryptographic identity, a trust tier and a named human owner. The enclave is the unit you assess, score and export.
What AWS provides, what Tovel adds, what you own.
If you already run AgentCore, this is the build-versus-buy question answered plainly. AWS supplies strong individual controls. Tovel supplies the integrated, evidenced workflow a regulated buyer has to show, and the operational ownership of it.
Your account, your decisions
- The AWS account, the data and the models in use
- Who approves what, and the risk threshold
- Retention mode and where evidence lands
- Incident response for your workloads
The governed workflow
- One enclave per application, with a named owner and trust tiers
- Approvals bound to the exact arguments, with expiry
- Versioned organisation rules and a journal of every change
- A deterministic checkpoint before anything is delivered
- Signed, hash-chained evidence you can export and verify
- Operating states, breakers and a stop that holds
The runtime
- Bedrock inference in your region
- AgentCore runtime, memory, gateway and identity
- Cedar authorisation at the gateway
- Agent Registry and Evaluations
What every governed turn passes through.
Six layers on every governed path, from the orchestration loop to a deterministic delivery checkpoint. The status on each card says what is shipped, what applies on governed paths only, and what is still in validation.
One governed turn
Illustrative trace · 6 stages · timings are not benchmarksAgent loop and organisation rules
A bounded plan-act-observe loop. Versioned organisation rules are loaded per run with a context hash, so the record shows which rules applied and who changed them. Rules guide the model; they do not guarantee obedience.
Model
Calls run against an allow-list of foundation models on AWS Bedrock in your region. Model choice is tier-scoped and recorded per run.
Role-scoped tools and approvals
Each tool is classified by its data, content and communications reach. The Rule-of-Two gate routes any action holding all three to a person. Approvals are bound to the exact arguments: change the arguments and the approval no longer applies.
Context and memory
Retrieval, memory and caching are provenance-tracked. Derived memories point back to their source records, so poisoned context can be traced and contained. Provenance does not prevent poisoning on its own.
Guardrails and history-aware policy
Content, safety and policy guardrails run per turn on governed paths. History-aware rules (approval must precede the action it approves, rate and budget windows) are integrated; production shadow validation is in progress and no enforcement result is claimed until a successful end-to-end soak is recorded.
Delivery checkpoint
A deterministic checkpoint blocks delivery when a stage is incomplete, a signature fails or a fallback report fails. Its verdict is sealed to the record. Model-judged review rules are an extension point, not a review of every turn.
Intervene while the agent is still running.
Every governed agent is observed live. Plan divergence is flagged, spend and behaviour thresholds trip breakers, and any agent can be stopped through a deliberate confirmation step. A stop takes effect at the next enforcement check and is sealed to the record; it does not undo an external action already underway.
The controls behind the scoreKnow what is inside, and how sound it is.
AI-system bill of materials. An inventory of models, tools, connectors and sub-agents per enclave. Runtime image digests are attributed to runs; a standards-aligned signed export and full attestation are separate work, listed on the Research page.
Security posture pipeline. The application inside each enclave is scanned across five domains and prioritised by exploitability using KEV and EPSS. Prioritisation ranks likelihood; it does not prove a finding is exploitable. Findings flow into the evidence locker.
Five states, and who moves an agent between them.
Buyers ask what happens when something goes wrong more often than what happens when it goes right. These are the states a governed agent can be in and what each one means for the people around it.
Running
Inside plan and budget. Every tool call checked, every turn recorded.
Waiting for approval
A named approver sees the exact action and arguments. Approvals expire.
Blocked
Policy or the approver said no. The agent continues without the action, or stops.
Halted
Breaker or a person. Resume needs the owner. External actions underway are not undone.
Did not deliver
Checkpoint blocked output or a stage failed. The failure is sealed like any other event.
What changed, and its status.
Status words mean the same thing everywhere on this site. Shipped: available on governed paths. Shadow: running and recording, not enforcing. In build: planned, with no release evidence yet.
3 more changes
Start with your riskiest agent.
In the walkthrough we run a governed workflow through the harness end to end and scope what putting an enclave around one of your agents would take.
