Authority stays with your people. The record proves it.
Governance in Arakno is a running service with its own database, not a paragraph in a prompt. Agents ask it for permission, and it writes down what happened either way.
Every action carries a class before it runs.
Classes are matched by the most specific rule that applies. A path nobody has classified does not slip through as harmless: it fails closed and asks for approval.
Class boundaries are agreed with you during onboarding and mapped to your own delegation rules.
What happens when something is held.
Classify
The policy engine resolves the class from the tool and the destination, not from what the model believes about itself. Unknown paths resolve upward, never downward.
Hold
The approval request stores the exact payload that would go out, who may approve it, and when the request expires. The agent stops there and continues with what it may still do.
Decide
A named person approves or rejects. Either way the decision joins the run, with the identity and the time attached. The approval key is never given to an agent, so no agent can approve its own work, and a decision with no named approver is rejected. Nothing is sent twice, because the send is recorded before it is repeated.
One id resolves the whole run.
When someone asks what the AI did on the fourteenth, the answer is not a search through chat logs. It is a single identifier that returns the task, the runs it spawned, every tool call, every artifact, the approval and the audit trail.
That is what makes the difference between an AI you can explain and one you can only apologise for.
The ledger is honest by construction.
A log that application code can quietly rewrite is not evidence. Arakno removes the possibility rather than promising restraint.
What the design prevents
- Updates and deletes on audit rows are blocked by the database, not by convention
- A correction is a new entry that supersedes the old one, and both remain readable
- The governance store has no column that could hold a credential value
- A model cannot argue its way past a class, because the class is resolved before it is asked
What you can therefore answer
- What did the system do for this customer, and on whose authority
- Which source produced the sentence that went out
- What was held, what was rejected, and by whom
- What changed after the change, and how to reverse it
Enforcement moves one reversible step at a time.
Turning full enforcement on at once is how good governance breaks a working business. Arakno advances through stages you control.
Observe
- Nothing blocksActions run as before while the governance service records what it would have decided.
- You read the differenceThe gap between current practice and the policy you want becomes visible before it costs you a send.
Consult
- Every path asksThe send path calls governance on each action and computes the verdict, still without blocking.
- Drafts mirrorReal drafts appear in the approval queue so your team can practise the workflow on live traffic.
Enforce
- Fail closedAn action above the threshold cannot proceed without a decision, and an unreachable governance service stops the send rather than waving it through.
- Break glass, recordedAn emergency override exists, is deliberate, and leaves its own entry.
Bring your auditor to the demo.
The parts of Arakno that are hardest to fake are the ones your risk team will ask about first. We would rather show those than a highlight reel.