CloviePolicies that are safe to turn on.
Every policy starts in monitor mode. Simulate it against your own recent traffic, then promote it with the evidence attached. Sensitive requests wait for a person. Compliance packs show how your agents measure up.
Keep account numbers out of prompts
| Card Dispute Triage | 29 would deny | |
| Collections Hardship Assistant | 9 would deny | |
| Deposit Account Servicing Bot | 3 would deny |
Decisions: allow, deny with a reason, or require approval.
Teams avoid enforcing rules they can’t test.
Fear of breaking production
A rule that blocks the wrong requests is worse than no rule, so most rules never leave the document.
Approvals happen in email
High-risk actions get waved through because there’s no way to pause one request.
Compliance is a separate project
Framework mapping lives in spreadsheets, far from the controls that actually run.
Clovie makes enforcement a lifecycle, not a switch: monitor, simulate, enforce, with one audited emergency path and nothing else.
No policy blocks a request until it has been shown to be safe on your own traffic.
See it at work
Audit log
| Time | Agent | Model | Decision |
|---|---|---|---|
| 14:02:11 | Card Dispute Triage | gpt-4o | Deny |
| 14:01:58 | Fraud Alert Triage | claude-sonnet-4.5 | Allow |
- Policy
- Card numbers stay out of prompts
- Mode
- Enforcing
- Reason
- Card number found in the prompt
- Provider call
- Not made
Evidence pack
- Agent
- Card Dispute Triage
- Decision
- Deny
- Policy version
- v3, enforcing
- Recorded
- 14:02:11 UTC
What you get
Monitor, simulate, enforce
Policies record what they would have done, replay against recent traffic, and are promoted only with evidence.
Break-glass, audited
In an emergency, enforce at once with a written reason and confirmation. The policy shows it was enforced without simulation, and admins can turn the option off.
Approvals
Hold a request until a person approves, with the policy’s reason, the full run trace and an expiry, with approvers notified in Slack.
Exemptions
Grant time-limited exceptions that expire on their own.
Policy Hub
Start from templates and industry packs: US banks, Canadian banks, telecommunications, cyber security and oil and gas OT.
Scoped policies
Apply rules per project and per environment, with production, staging and development inheriting from the organization.
Also in this layer
| Capability | What it does |
|---|---|
| Compliance packs and dashboard | SOC 2 Type II, NIST AI RMF, EU AI Act, OSFI E-23 and ISO/IEC 42001, with automated checks and manual attestations that can expire. |
| Model oversight and risk | Risk classification, independent reviews, board reporting, a risk register and vendor risk assessments. |
| Environment and cloud guardrails | Keep test agents away from production, and check that agents can’t reach providers around the gateway. |
Controls mapped to the frameworks you answer to
- SOC 2: SOC 2 Type II trust services criteria
- NIST AI RMF: NIST AI Risk Management Framework
- EU AI Act: EU Artificial Intelligence Act
- ISO/IEC 42001: ISO/IEC 42001 AI management system
- OSFI E-23: OSFI Guideline E-23, model risk management (Canada)
- OWASP Top 10: OWASP Top 10 for LLM applications and agentic AI
Runs wherever Clovie runs
- SaaS
- Customer VPC
- On-premises
- Air-gapped
The policy engine runs next to every gateway in every mode. Policy bundles ship with the release, so air-gapped installs need nothing extra.
Questions
Can a policy block traffic the moment it’s created?
No. Every policy starts in monitor mode. The only way to enforce without a simulation is break-glass, which needs a written reason, is audited and can be turned off.
Who can promote a policy?
Org admins and policy admins. Agent operators can edit policies that are not enforcing.
What decisions can a policy make?
Allow, deny with a reason, or require approval from a person.
Is there a pack for US model risk guidance?
There is no separate compliance pack; the US bank policy pack applies model risk practices such as inventory, risk tiers and overdue reviews to agents.
Walk into your next review with controls that actually run.
See policy and governance on your own agents, in the deployment you need.