GOVERNANCE RUNTIME FOR ENTERPRISE AI AGENTS
Enforced before execution. Evidenced in the same transaction.
Orkena authorizes every agent action against your policies before it touches a system, and writes the audit record in the same database transaction that executes it. The trail is the enforcement, not a report about it.
▶ RUN r_01J8F3TQ4M · streaming events
streaming417↑
ledger_seq · ws_finance-ops
6↑
gates_held · this workspace
#0042─
anchor · ws_finance-ops
3.9%─
engine_overhead
▸ one demo workspace, live in this browser — not aggregate production traffic. Orkena is pre-launch; see the honest state of the runtime.
SEQ 0001 · THE GAP
Regulated institutions cannot deploy agents they cannot prove.
Supervisors expect determinism, traceability and reproducibility. Language models are probabilistic by construction. That gap is why agent programmes stall at pilot — not model quality.
TODAY'S OPTION A · ASSEMBLE THE STACK
Combine a runtime, an observability platform, an identity layer, a policy engine and a bespoke audit store. Five separate systems to integrate, and evidence is still assembled by hand when the examiner asks.
five systems, one integration project · evidence hand-assembled
TODAY'S OPTION B · BUY A DASHBOARD
Governance platforms observe and report what agents did, after they did it. Reporting is not a control. Nothing was prevented.
after the fact
event stream:
14:02:11 agent did X logged
— too late to prevent
Neither is a substrate. Neither is what a regulator asks for.
SEQ 0002 · FIVE COUPLINGS
Five couplings that have to be in one system.
Each of these exists somewhere in the market. Bought separately, the seams between them are exactly where the assurance leaks.
SEQ 0001
Authorize before the action.
Every edge traversal, tool call, credential use and model call is evaluated against policy-as-code in under five milliseconds — before any output reaches a system of record. A denial is a control that fired, not an incident that was noticed.
policy.baseline-security v3 · Cedar-native
forbid (
action in [Action::"invoke_tool"]
) when {
resource.side_effects == "irreversible"
&& context.tainted
};SEQ 0002
Evidence in the same transaction.
The audit record is committed atomically with the step that produced it, into a hash-chained ledger with signed anchors. There is no window in which an action exists without its evidence, and no path by which the record can be edited afterwards.
SEQ 0416 ← prev 8c31…a09d
SEQ 0417 ← prev 4f9a…c7e1
SEQ 0418 ← prev 3e12…b8ff
anchor #0042 · Ed25519 · verified
SEQ 0003
Reproduce any run, exactly — and interrogate the decisions.
Runs are event-sourced. Every non-deterministic interaction — model responses, tool results, timestamps, retrieval hits — is recorded in the ledger. Any run can be replayed step by step with byte-level fidelity, or forked from any checkpoint to test what a different input, policy version or threshold would have produced. Both runs stay linked in the ledger.
RUN r_01J8F3T9K2 · 14 steps · SEQ 0388–0417
● ● ● ● ● ● ● ● ● ● ● ● ● ●
FORK from SEQ 0121 · amount 12,400 → 500
● ● ● ● ● ● ● ● ● ○ ○ ○ ○
alternate: [ALLOWED, no gate]
SEQ 0004
Change only through tested updates.
No version reaches production without passing its regression evaluation suite. When the system proposes a new operating rule for itself, that rule stays inert until it passes the same suite and a human declines to veto it.
eval evs_refund_regression
v1.3 · 4.6 / 5.0 · PASS
PROMOTE v1.3 → prod
✓ ledger SEQ 0421 · anchor 0042
SEQ 0005
Adjudicate the claim, not just the action.
A denial answers whether an action should happen — not whether a number is right. Where a domain has an encoded rule — a covenant formula, a clinical threshold, a statutory limit — the evaluator recomputes independently and checks the agent's claim against it: pass, fail, and by how much. The agent proposes the number; the engine decides whether it holds.
The check-and-retry machinery ships today — deterministic assertions, evaluated in-process, the violation fed back on failure. Authoring a domain's rules as named, reusable axioms — a formula once, applied to every run — is building next.
axiom icr · Interest Coverage Ratio
define: ebitda / interest_expense
constraint: >= 2.0
computed 1.8 · required ≥ 2.0
VIOLATED by 0.2 · retry issued with the violation
In one substrate, or the seams leak. Bought separately, they do.
Read the concept docs → Policy packs· Hash-chained ledger· Runs & replay· Evaluation suites
▸ What five couplings cost
| CONFIGURATION | END-TO-END (MEDIAN) | DELTA |
|---|---|---|
| LangGraph, governed | 3,534.06 ms | — |
| Orkena, governed | 3,674.73 ms | +4.0% |
Engine share of wall-clock: 3.9%. Method, workloads and raw results at /benchmark — rerun in your environment before quoting.
SEQ 0003 · MEMORY UNDER GOVERNANCE
Learning happens. It does not deploy itself.
Agents accumulate signal across runs — what worked, what failed, what a retrieval turned up that was actually useful. Left alone, this accumulation is drift: an agent that behaves differently next quarter for reasons no one can trace. Governed, it becomes controlled improvement.
Overnight, the runtime consolidates what the fleet learned across runs — merges duplicate memories, surfaces contradictions between agents’ understandings of policy or context, and proposes rule refinements the runtime observed would have improved outcomes. Nothing proposed activates. A human reviews (or ignores) the proposals; those that survive the review window are promoted through the same eval-gated path as any other change.
The distinction is load-bearing for regulated deployments. An AI system that changes its own behavior between examinations is one an examiner cannot reason about. Memory consolidation with a human veto keeps the system improvable and the improvement auditable — both.
▶ OVERNIGHT CONSOLIDATION · 2026-08-15 · workspace ws_finance-ops
MERGED 47 duplicate memories collapsed
ARCHIVED 12 stale memories retired
CONTRADICTIONS 3 surfaced for review
─ refund_bot: refunds >$5k always require approval
─ triage_bot: refunds >$10k always require approval
─ policy: neither is the current rule
RULES PROPOSED 2 refinements queued
─ pending review (24h veto window · 2 reviewers)
Rules proposed do not activate. Human veto window closes → eval gate runs → change promoted.
Full mechanics → Memory consolidation and gated reflection
SEQ 0004 · EVIDENCE LAYER
Evidence a regulator can verify — without depending on us.
Every authorization, execution, approval and administrative action is appended to a per-institution hash chain. Each entry carries the hash of the one before it, so any alteration, deletion or reordering invalidates everything downstream.
The chain is anchored periodically with an Ed25519 signature. Anchors and public keys travel inside the export, so verification does not depend on Orkena being available, online, or still in business.
An evidence bundle for any run or date range exports as a signed archive: the ledger slice, the payloads at your configured retention, a readable report, and a dependency-free verification script. Your auditor runs it on their own machine.
▶ Orkena · Evidence Bundle · EV-01J8F3TQ4M
GENERATED 2026-08-15T09:14:22Z
RUN r_01J8F3T9K2 · refund-approval v1.3
RANGE SEQ 0388 – 0417
HASH 4f9a…c7e1
ANCHOR #0042 · Ed25519 · verified
| POLICY | OBJECT | VERDICT |
|---|---|---|
| baseline-security v3 | call_model | ALLOWED |
| pii-guard v1 | edge n_triage → n_pay | ALLOWED |
| baseline-security v3 | issue_refund (tainted) | DENIED |
| gate.hitl | ops_lead a.mehta | APPROVED |
▶ verify.py · run in your browser
▍
▶ This actually runs in your browser (simulated for the marketing site; the real verify.py is dependency-free Python you run offline on your auditor's machine. Get a real bundle at /docs/evidence-bundles.)
Read more → Evidence bundles· The hash-chained ledger
SEQ 0005 · ADOPTION
Adopts into what you already run.
No agent runtime survives in a regulated institution by asking you to rebuild your infrastructure. Orkena is designed to enter your stack as an addition, not a replacement.
▸ EXISTING INFRASTRUCTURE
Runs where you run.
Orkena runs on your Kubernetes, uses your Postgres, emits to your OpenTelemetry, encrypts under your KMS, and authenticates against your identity provider. Model providers are bring-your-own-key across Anthropic, OpenAI, Azure OpenAI, and Bedrock. Existing agent workflows (LangGraph, CrewAI, AutoGen) import as first-class graphs.
▸ PILOT TO PRODUCTION
Start small. Scale by config.
One workspace, one graph, one policy pack. Prove the audit posture on a low-stakes workflow before scaling. Every workspace is isolated (per-tenant row-level security + per-tenant hash chain); scaling from pilot to org-wide production is a configuration change, not a rebuild.
▸ TEAM RAMP
Canvas ↔ code parity.
Every graph is also a versioned, diffable DSL definition. Platform engineers work in either surface. What compliance officers see — the ledger, the evidence bundles, the policy diffs — is what production actually did, not a rendered dashboard version of it.
▸ INTEROP — MCP · A2A · LangGraph adapter · Anthropic · OpenAI · Azure OpenAI · Bedrock · OpenTelemetry emitter · Ed25519 · SAML / OIDC / SCIM · Bring your own KMS · Bring your own Postgres
Guides → Quickstart· Durable execution· Import from LangGraph· Model provider setup· Deployment options
SEQ 0006 · COMPLIANCE
Mapped to the regimes you are examined against.
Compliance is treated at most institutions as a documentation project — write policies, screen outputs, produce reports for the auditor. That approach produces documents that are true at the moment they were written and stale thereafter, and evidence that has to be assembled by hand when an examiner asks.
Orkena treats compliance as a byproduct of the runtime, not a project run alongside it. The runtime is the control (policy enforcement in the transaction path); the ledger is the evidence (hash-chained, signed, offline-verifiable). What a regulator asks for is produced from the record of what happened, not reconstructed after the fact.
Orkena is not certified against these frameworks on your behalf. It produces the runtime controls and the evidence your own certification and supervisory processes require.
▸ Full regime-by-regime mapping — DORA, EU AI Act, ISO/IEC 42001, NIST AI RMF, SOC 2 — at /compliance
▸ SECURITY — Per-tenant RLS · envelope encryption under your KMS · scoped agent credentials · egress control on code execution · prompt-injection quarantine
SEQ 0007 · DEPLOYMENT
Deploy where your data has to stay.
▸ CUSTOMER VPC
Your VPC. Shipping today.
Single Helm chart, your Kubernetes, your key management, your network. Orkena provides the software; you run the operations.
▸ AIR-GAPPED
Air-gapped. Shipping today.
Offline installation bundle including local models for embeddings and classifiers. No outbound connectivity required, ever. Same feature set as the Helm chart.
▸ MANAGED TIER — ROADMAP
SaaS, region-pinned. 2027.
Data at rest never leaves the region you select. Orkena operates the infrastructure; you consume the API. Design partners first — GA follows the first VPC deployments and SOC 2 Type II.
▸ ONE HELM CHART · FEATURE PARITY ACROSS ALL THREE
SEQ 0008 · FAQ
Common questions.
Put an agent in production you can defend.
A 30-minute technical walkthrough: a live policy denial, a run replayed from a checkpoint, and an evidence bundle verified on your own machine.
▸ info@orkena.com · reply within one business day
▸ Design partner programme — four institutions, 2026
One real workflow taken to production, not a sandbox pilot — with direct engineering access and control mappings built against your own supervisory obligations. Four openings, selective — not a waitlist.