AI agents can now do real things: delete files, move money, email your customers. Arcezia checks each tool call, and the facts it rests on, before it runs. Then it gives one of three answers: ALLOW (go ahead), BLOCK (no), or REVIEW (ask a person). It takes 57 to 71 milliseconds of checking, depending on the run, and every answer comes with a receipt you can check later.
pip install arcezia
It runs commands, edits files, calls APIs, moves money, deploys to production. A perfectly innocent request, “show me recent login stats”, can produce an action that deletes a table. The words look fine. The consequence is irreversible.
Each one is a sequence of tool calls that looked fine on its own.
LangChain and LangGraph, OpenAI function calling, Anthropic tool use, CrewAI, AutoGen and LlamaIndex, n8n, and a hook for Claude Code. It checks actions against Postgres, MySQL, Snowflake and BigQuery, against filesystems and object storage, against Stripe and other payment APIs, and against deploys to Kubernetes, Terraform and AWS, GCP or Azure. Each record is signed and states the decision and its reason.
Between 57 and 71 milliseconds of checking depending on the run, plus the network, and the same answer every time for the same inputs. There is no language model in the decision, so it cannot drift between runs. On the public GAP benchmark Arcezia caught 7,594 of 7,594 dangerous calls. On a fresh setup it also stopped every harmless call it could not verify, rather than guessing. On the GAP benchmark, fresh setup, nothing declared (September 2026): 0 of 7,594 dangerous calls allowed, and all 3,740 harmless calls stopped too, 3,423 held for a person and 317 blocked. Held is not refused: each held call names what would release it, such as a person's approval or a statement of what the tool does.
A development key costs nothing and covers three areas, so you can build against it and evaluate it properly before talking to anyone. Production access is agreed with us directly.
Arcezia is in private beta. Not SOC 2 audited yet — we say so before you ask.
AI agents can now do real things, delete files, move money, email your customers. Arcezia checks each action, and the facts it rests on, before it runs. Then it gives one of three answers: ALLOW (go ahead), BLOCK (no), or REVIEW (ask a person). It takes about 71 milliseconds, and every answer comes with a receipt you can check later.
It runs commands, edits files, calls APIs, moves money, deploys to production. Everything guarding it still reads text, the prompt and the reply. But a perfectly innocent request, “show me recent login stats”, can produce an action that deletes a table. The words look fine. The consequence is irreversible.
You’re trusting that the agent did the right thing. You find out whether it did after it has already happened.
You have proof the action was allowed before it ran - a deterministic verdict and a signed certificate you can hand to an auditor.
Every action your agents take is already in one of these two states. There is no third. The only question is which one you can prove.
A scripted demo of three example calls: pick one and press Verify to see the kind of answer Arcezia gives. For real answers on your own calls, get a free key.
Real failures from production, 2024-2026. Each one is a sequence of tool calls that looked fine in isolation.
Add one line above any function your AI can call. If you use LangChain, CrewAI, Claude Code, Cursor, or something similar, we already have a ready-made hookup.
We do not take the AI’s word for anything. We look things up ourselves, is this the test database or the real one? Was a backup taken? Is that person really an approver? Anything the AI just claims gets thrown out.
ALLOW hands back a one-time pass, good for that one action only. BLOCK says no and tells you which rule it broke. REVIEW pauses and asks a person. Without the pass, the action simply does not run.
Use as many as the risk warrants. Checking each call is where every integration starts.
Every tool call is checked against the job and your rules before it runs.
Check several steps at once, or keep one session: each step is judged with what came before.
Report what happened and it is compared with what was approved. Any gap is flagged.
For your highest-stakes actions, register a dry run of your own. A result bigger than allowed does not run.
Safety here isn't a list of known-bad patterns to keep up with. Anything we cannot check never reaches ALLOW: a novel phrasing, a new encoding, an attack that didn't exist yesterday. It is held for a person or refused.
Keep the tools you already have for filtering bad language and catching sneaky prompts, they do a real job. We are not trying to replace them. We sit one step further down, at the moment the AI actually does something. Two different jobs, not two vendors fighting over one.
You add Arcezia without removing anything, no migration, no rip-and-replace.
Each row is a result we measured on the same tests.
882 evaluations: 126 scenarios across database, filesystem, payment, email, and agent-action, run identically against seven systems. Three are shown here. Independently verifiable on the GAP and ODCV-Bench public datasets.
In our tests, Arcezia blocked every harmful action whose harm shows in the call itself - ransomware, credential theft, log deletion, database exfiltration. When only the goal differs, two identical tool calls with different intentions, we hold it for a person instead of guessing, and we say so.
On the GAP benchmark, fresh setup, nothing declared (September 2026): 0 of 7,594 dangerous calls allowed, and all 3,740 harmless calls stopped too, 3,423 held for a person and 317 blocked. Held is not refused: each held call names what would release it, such as a person's approval or a statement of what the tool does. We state the condition next to the number.
Verify in the framework, at the path, or behind a gateway, then stream every signed verdict to the tools your security team already runs.
Arcezia is in private beta. A development key is free and covers three areas, so you can build and evaluate at no cost. Production access is agreed with you directly. Join the waitlist and you get in before it is public.
"I shipped my first agent into production in early 2024. By Q3 we had three near-misses with destructive tool calls. Arcezia is the safety layer I needed and couldn't find, built so the next team doesn't have to."
An agent tries to wire a $48,000 refund to an account it can’t verify. Arcezia can’t confirm the approval, returns REVIEW, and a human signs off before a cent moves.
AI agents can now do real things, delete files, move money, email your customers. Arcezia checks each action, and the facts it rests on, before it runs. Then it gives one of three answers: ALLOW (go ahead), BLOCK (no), or REVIEW (ask a person). It takes about 71 milliseconds, and every answer comes with a receipt you can check later.
It runs commands, edits files, calls APIs, moves money, deploys to production. Everything guarding it still reads text, the prompt and the reply. But a perfectly innocent request, “show me recent login stats”, can produce an action that deletes a table. The words look fine. The consequence is irreversible.
You’re trusting that the agent did the right thing. You find out whether it did after it has already happened.
You have proof the action was allowed before it ran - a deterministic verdict and a signed certificate you can hand to an auditor.
Every action your agents take is already in one of these two states. There is no third. The only question is which one you can prove.
A scripted demo of three example calls: pick one and press Verify to see the kind of answer Arcezia gives. For real answers on your own calls, get a free key.
Real failures from production, 2024-2026. Each one is a sequence of tool calls that looked fine in isolation.
Add one line above any function your AI can call. If you use LangChain, CrewAI, Claude Code, Cursor, or something similar, we already have a ready-made hookup.
We do not take the AI’s word for anything. We look things up ourselves, is this the test database or the real one? Was a backup taken? Is that person really an approver? Anything the AI just claims gets thrown out.
ALLOW hands back a one-time pass, good for that one action only. BLOCK says no and tells you which rule it broke. REVIEW pauses and asks a person. Without the pass, the action simply does not run.
Use as many as the risk warrants. Checking each call is where every integration starts.
Every tool call is checked against the job and your rules before it runs.
Check several steps at once, or keep one session: each step is judged with what came before.
Report what happened and it is compared with what was approved. Any gap is flagged.
For your highest-stakes actions, register a dry run of your own. A result bigger than allowed does not run.
Safety here isn't a list of known-bad patterns to keep up with. Anything we cannot check never reaches ALLOW: a novel phrasing, a new encoding, an attack that didn't exist yesterday. It is held for a person or refused.
Keep the tools you already have for filtering bad language and catching sneaky prompts, they do a real job. We are not trying to replace them. We sit one step further down, at the moment the AI actually does something. Two different jobs, not two vendors fighting over one.
You add Arcezia without removing anything, no migration, no rip-and-replace.
Each row is a result we measured on the same tests.
882 evaluations: 126 scenarios across database, filesystem, payment, email, and agent-action, run identically against seven systems. Three are shown here. Independently verifiable on the GAP and ODCV-Bench public datasets.
In our tests, Arcezia blocked every harmful action whose harm shows in the call itself - ransomware, credential theft, log deletion, database exfiltration. When only the goal differs, two identical tool calls with different intentions, we hold it for a person instead of guessing, and we say so.
On the GAP benchmark, fresh setup, nothing declared (September 2026): 0 of 7,594 dangerous calls allowed, and all 3,740 harmless calls stopped too, 3,423 held for a person and 317 blocked. Held is not refused: each held call names what would release it, such as a person's approval or a statement of what the tool does. We state the condition next to the number.
Verify in the framework, at the path, or behind a gateway, then stream every signed verdict to the tools your security team already runs.
Arcezia is in private beta. A development key is free and covers three areas, so you can build and evaluate at no cost. Production access is agreed with you directly. Join the waitlist and you get in before it is public.
"I shipped my first agent into production in early 2024. By Q3 we had three near-misses with destructive tool calls. Arcezia is the safety layer I needed and couldn't find, built so the next team doesn't have to."
An agent tries to wire a $48,000 refund to an account it can’t verify. Arcezia can’t confirm the approval, returns REVIEW, and a human signs off before a cent moves.
AI agents can now do real things, delete files, move money, email your customers. Arcezia checks each action, and the facts it rests on, before it runs. Then it gives one of three answers: ALLOW (go ahead), BLOCK (no), or REVIEW (ask a person). It takes about 71 milliseconds, and every answer comes with a receipt you can check later.
It runs commands, edits files, calls APIs, moves money, deploys to production. Everything guarding it still reads text, the prompt and the reply. But a perfectly innocent request, “show me recent login stats”, can produce an action that deletes a table. The words look fine. The consequence is irreversible.
You’re trusting that the agent did the right thing. You find out whether it did after it has already happened.
You have proof the action was allowed before it ran - a deterministic verdict and a signed certificate you can hand to an auditor.
Every action your agents take is already in one of these two states. There is no third. The only question is which one you can prove.
A scripted demo of three example calls: pick one and press Verify to see the kind of answer Arcezia gives. For real answers on your own calls, get a free key.
Real failures from production, 2024-2026. Each one is a sequence of tool calls that looked fine in isolation.
Add one line above any function your AI can call. If you use LangChain, CrewAI, Claude Code, Cursor, or something similar, we already have a ready-made hookup.
We do not take the AI’s word for anything. We look things up ourselves, is this the test database or the real one? Was a backup taken? Is that person really an approver? Anything the AI just claims gets thrown out.
ALLOW hands back a one-time pass, good for that one action only. BLOCK says no and tells you which rule it broke. REVIEW pauses and asks a person. Without the pass, the action simply does not run.
Use as many as the risk warrants. Checking each call is where every integration starts.
Every tool call is checked against the job and your rules before it runs.
Check several steps at once, or keep one session: each step is judged with what came before.
Report what happened and it is compared with what was approved. Any gap is flagged.
For your highest-stakes actions, register a dry run of your own. A result bigger than allowed does not run.
Safety here isn't a list of known-bad patterns to keep up with. Anything we cannot check never reaches ALLOW: a novel phrasing, a new encoding, an attack that didn't exist yesterday. It is held for a person or refused.
Keep the tools you already have for filtering bad language and catching sneaky prompts, they do a real job. We are not trying to replace them. We sit one step further down, at the moment the AI actually does something. Two different jobs, not two vendors fighting over one.
You add Arcezia without removing anything, no migration, no rip-and-replace.
Each row is a result we measured on the same tests.
882 evaluations: 126 scenarios across database, filesystem, payment, email, and agent-action, run identically against seven systems. Three are shown here. Independently verifiable on the GAP and ODCV-Bench public datasets.
In our tests, Arcezia blocked every harmful action whose harm shows in the call itself - ransomware, credential theft, log deletion, database exfiltration. When only the goal differs, two identical tool calls with different intentions, we hold it for a person instead of guessing, and we say so.
On the GAP benchmark, fresh setup, nothing declared (September 2026): 0 of 7,594 dangerous calls allowed, and all 3,740 harmless calls stopped too, 3,423 held for a person and 317 blocked. Held is not refused: each held call names what would release it, such as a person's approval or a statement of what the tool does. We state the condition next to the number.
Verify in the framework, at the path, or behind a gateway, then stream every signed verdict to the tools your security team already runs.
Arcezia is in private beta. A development key is free and covers three areas, so you can build and evaluate at no cost. Production access is agreed with you directly. Join the waitlist and you get in before it is public.
"I shipped my first agent into production in early 2024. By Q3 we had three near-misses with destructive tool calls. Arcezia is the safety layer I needed and couldn't find, built so the next team doesn't have to."
An agent tries to wire a $48,000 refund to an account it can’t verify. Arcezia can’t confirm the approval, returns REVIEW, and a human signs off before a cent moves.