EvasLabs
TRBook a demo
Menu
PlatformStudioSolutionsServicesSecurityPricingTake the 3-minute tourTürkçeBook a demo

Everything an agent does, decided and recorded.

Build in the Sandbox. Release with a signature. Run in Production under policy.

The palette is the catalog.

Builders compose from capabilities your organization admitted. No canvas step makes an ungoverned network call.

StudioClaims intake v4
Starttriggerwebhook, mailbox, schedule or stream
Read the claimAI stepdefault model, 2 knowledge sources
Policy lookuptoolPolicyAdmin MCP server, read-only
Check fraud signalssub-workflowFraud triage v2, pinned
An adjuster decidespersonapprover role, Inbox
Step settingsRead the claim
Model
Your default modelin-region
Tools it may call
PolicyAdmin, ClaimsHistoryread-only
Knowledge
Policy wording 2026, Runbooksconfidential
Output schema
ClaimAssessment v3enforced in Production
Autonomy
Superviseddeclared
Workflows inside workflowsPinned to a version, one budget, one timeline.
Tests tabCases, judge scores, diffs, side-by-side runs.
Benchmarked templatesChatbot and background job, fully wired.
Assistant in the consoleRuns as you, only reads, you confirm changes.
Illustrative workflow

Every action is checked before it happens.

Before an agent uses a model, a tool or your data, your rules decide: allowed, blocked, or a person decides. There is no way to switch this off.

Using an AI modelActing in a systemReading your documentsRemembering information
Your rulescompany-wide, then per agent
Allowedgoes ahead and is recordedBlockedstopped before it happensA person decideswaits in the Inbox
Recorded

If the rules cannot be checked, the answer is no.

Policy that only narrows.

Three layers combine and the strictest rule wins. A lower layer can never grant what a higher one refused.

  • Payments up to 10,000 run automatically. Above that, a person approves.
  • No more than three high-risk calls per session.
  • Confidential data is answered only by in-region models.
Platform floorSet by the installation. Cannot be switched off.
Organization baselineYour compliance rules.
Agent policyWhat this agent may do.Effective policy
Guardrails on every agent from its first request
  • Prompt injection, also inside retrieved documents
  • Personal data in answers
  • Harmful output
  • Answers that do not cite their sources

People stay in charge.

When your rules say a person decides, the work waits for them in one Inbox: customer consent, approvals and changes alike.

  • Waiting never approves anything.
  • Four-eyes: nobody decides their own request.
  • Decide from email, protected by a one-time code.
InboxWaiting for you
Operational approvalwaiting 12 min
Pay 8,400 on claim #4471Claims intake, step 5
ApproveReject
Change approvalsecond person needed
Release Claims intake v4 to Production2 new tools, 1 of them writes
Customer consentconfirmed
Customer confirms the transferIn-app chat
Illustrative example

Two segregated zones. One signed path between them.

Sandbox and Production are separate deployments with no shared database, event bus or API path. The only thing that crosses is a signed OCI artifact in your own registry, and Production verifies each one before applying it.

Sandbox zone (Hub)Author, test, approve
  • Studio, Tests, release approval
  • Own PostgreSQL 16, Redis and PDP
  • Own credential store (sandbox keys)
  • Own audit chain
  • Own OIDC client
  • Roles: viewer, builder, approver, admin
push, signed
Your OCI 1.1 registry
  • Signed release bundle
  • Policy exception
  • Organization access state
  • Knowledge-base corpus
Rollback request
pull, verify, apply
the only thing Production can push
Production zoneRun signed releases only
  • Runtime: leased queue, horizontal workers
  • Own PostgreSQL 16, Redis and PDP
  • Own credential store (production keys)
  • Own audit chain
  • Own OIDC client, step-up MFA
  • Roles: viewer, approver, ops, admin
  • No authoring tools deployed
  • No shared database
  • No shared event bus
  • No API path from Sandbox to Production
  • Credentials never cross
  • Production runs on if the Sandbox is down
Crosses the boundary
Release bundleWorkflow version, compiled policy, capability manifest, output schemas, evaluation summary
Policy exceptionTime-limited, one workflow, one guardrail; revocation always wins
Organization access stateWhich organizations may run, signed per organization
Knowledge-base corpusContent for retrieval, versioned with the release
Rollback requestFrom Production back to the Sandbox, decided there as a change approval
Never crosses
Credentials, keys and secrets
Run data, prompts and responses
Production audit records
User sessions and tokens
Any network call between the zones
Production refuses
An artifact signed for another organization
An older release, unless a signed rollback names it
A registry credential that can do more than push rollback requests

Air-gapped Production? Copy the artifacts across with standard OCI tools. Verification is the same.

The release review is the gate.

The approver sees the diff to the live version and every capability the release brings, with read or write, the system it touches and its action class.

  • Credentials never travelA Production approver supplies Production’s own keys.
  • Rollback by signed requestDecided in the Sandbox as a change approval.
  • Attended and unattendedChat, or triggers: schedule, webhook, file, stream, mailbox.
Release reviewClaims intake v4
PolicyAdminMCP serverread
CasesServiceNow connectorwrite
Policy wording 2026knowledge sourceread
Default modelmodel connection, in-regionmodel
Latest tests for this version: 22 of 24 passedfor information, not a pass mark
Sign off release

Proof your auditor can check.

Every decision is written to a tamper-evident record that an auditor can verify on their own, without access to your systems.

  • Each company in your group keeps its own record
  • An optional copy that can never be changed
  • Personal data can be erased and the record still verifies
#10482Policy decisiontool call allowed9f2c…a71e
#10483Approvaldecided by an adjusterprevious 9f2c…a71e
41b0…7cd2
#10484Guardrailpersonal data maskedprevious 41b0…7cd2
c83e…0f19
#10485ReleaseClaims intake v4 appliedprevious c83e…0f19
5a6d…e204
Signed checkpointKMS / HSM
Offline verifierChain intact

Any model. Your systems. One governed path.

Self-hosted or cloud models and the systems you already run, all behind the same policy and audit.

Your own models
vLLMOllamaTGILM StudioLiteLLM
Cloud presets
AnthropicOpenAIGoogleAmazon BedrockAzure OpenAI
Governed gateway
  • Residency on every endpoint
  • Entitlement-filtered retrieval
  • Every address checked when dialled
Your systems
Microsoft 365TeamsGoogle WorkspaceSlackServiceNowJiraSalesforceSAPSharePointSQLGitHub
Knowledge that stays in sync
FoldersGitSharePointS3ConfluenceGoogle Drive

Simulated results exist only in the Sandbox, and are always labelled.

Tested before savingA probe calls each model and names the problem in plain words: DNS, TLS, authentication.
Residency on every callA connection without a region label is refused by any rule that names regions.
Routing within policyFallback picks only from models the policy allows for that data.

One installation, many business units.

Organizations hold legal and regulatory boundaries. Workspaces hold teams.

Bank A.Ş.own data, keys, audit chain, policy
Retail lendingPaymentsCompliance
Insurance A.Ş.own data, keys, audit chain, policy
ClaimsUnderwriting

Workspace roles narrow what the organization role allows: owner, editor, viewer.

Illustrative layout

Your operations team hears about it first.

Incidents, alerts and exports to the tools you already run.

Unusual behaviouragainst the agent’s baseline
Latencystep 3 at 3.4 times its baseline
Costtokens doubled on one run
Blocked2 calls in 4 minutes, incident opened
Kill switch
Stop anything liveOpens an incident. Releasing it needs a second person.
An organizationAn agentA toolAn MCP server
Alerts go where your teams work
Signed webhookSlackMicrosoft TeamsPagerDutyEmail
Export, don’t rebuild
OpenTelemetryYour SIEMPrometheusGrafana dashboards

Metadata by default. Prompts and responses only if you opt in.

Illustrative figures

Show the board what each workflow delivers.

A value card per live workflow, built from Production records. Every figure says whether it is measured or estimated.

ValueLast 90 days
Units completed12,480+18%measured
Straight-through rate71%+6 ptsmeasured
Hours freed1,930 hvs baselineestimated
AI cost per unit$0.42−9%measured
Workflows by straight-through rate
Claims intake82%
KYC review64%
Invoice matching51%
IT ticket triage38%
Governance at work
Approvals required312
Actions blocked41
Kill-switch engagements0
Illustrative figures

See your own workflow governed, end to end.

A 30-minute demo on a workflow from your world. No slides.

Book a demoAsk about services