Skip to content
XEVRION
Get started
Menu
ProductOverviewReviewProveControlObserveImproveHow it works
TeamsEngineeringSecurityComplianceOperations
CompanyAboutContactChangelogSecurity
ResourcesDocsGlossaryFAQPricingPrivacy
Control

How do I stop an agent doing too much?

Set limits, ask for a second owner on risky changes, pin your data to a region, and lock it with your own key.

Control

Blast-radius limits

Limit how many requests and how much spend a single agent may raise in a rolling window.

  • Requests and spendTwo dials per agent: how many, and how much money.
  • Enforced as it happensChecked when the request is created, so two at once cannot both slip through.
  • Signed attestationExport a signed statement of the limit and how full it is, for an auditor or insurer.
How Blast-radius limits works →
app.xevrion.co.uk / agents / refund-agent / limitsExample data

Used in the last hour

Rolling window
  • Requests raised36 of 50
  • Spend asked for£4,100 of £10,000
  • Critical actions0 of 2

Limit

Agent
refund-agent
Window
60 minutes
At the limit
Pause the agent
Attestation
Signed hourly

If the agent loops

  1. Request 50 raised
  2. Request 51 refusedlimit reached
  3. Owner told in Slack
  4. Signed note of what was refused

Control

Two-person approval

Sensitive owner actions wait for a second owner to agree. Their approval works once, for that exact call.

  • Covers the big leversRetention, legal hold, erasure, single sign-on, log export, roles, limits and region.
  • One use onlyThe grant is tied to the exact call and lasts an hour.
  • Both names recordedWho asked and who agreed are in the log.
How Two-person approval works →
app.xevrion.co.uk / settings / owner-actionsExample data

Waiting for a second owner

Owner actions
  • Change region to EUAsked by Dan R.1 of 2
  • Turn off two-person approvalAsked by Dan R.1 of 2
  • Export all decisionsAsked by Mia K.Done

Change region to EU

First owner
Dan R. · 11:02
Second owner
Waiting
Their approval
Works once, for this call
Recorded
Both names, signed

Always needs two

  • Region changes
  • Key changes
  • Role and SSO changes
  • Policy switch-off

Control

Set how long data is kept, pause deletion for a legal hold, and erase on request without breaking proofs.

  • Retention rulesChoose how long request data is kept before it is redacted.
  • Legal holdFreeze deletion for a case until the hold is lifted.
  • Proofs surviveA redaction is itself logged, and the signed record stays checkable.
How Legal hold and retention works →
app.xevrion.co.uk / settings / dataExample data

Retention

By kind of data
  • Request payloadsDelete after90 days
  • Reviewer commentsDelete after1 year
  • Signed receipts and proofsKeepKept
  • Case 2026-044 legal holdDeletion pausedHold

Erase on request

  1. Request received
  2. Personal fields removed
  3. Hashes and signatures kept
  4. Proofs still verify

Legal hold

Scope
Refund requests, Oct 2026
Placed by
Mia K.
Deletion
Paused

Control

Region pinning

Pin your organisation to a region. Every other region refuses its requests, and a signed note says where it runs.

  • A database per regionUK, EU and US each have their own database, storage and queue.
  • Other regions say noA request that lands in the wrong region is refused, not quietly served.
  • Move with a checkA tool moves an organisation between regions and proves the copy matches before the old one is removed.
How Region pinning works →
app.xevrion.co.uk / settings / regionsExample data

Regions

One database each
  • United KingdomPinned for Acme SupportHome
  • European UnionWould refuse these requestsRefuses
  • United StatesWould refuse these requestsRefuses

Request from the wrong region

  1. Reaches the EU region
  2. Not your home region
  3. Refused, nothing stored

Signed note

Runs in
United Kingdom
Since
2 Mar 2026
Signature
Valid

Control

Encryption and your own key

Turn on encryption for stored review data. Enterprise can hold the key in a service you run.

  • Own data keyEach organisation gets its own key. Requests, events, replies and attachments are sealed.
  • Your key, if you want itA key service you run can lock the data key. Revoke it and access stops.
  • Destroy to eraseDestroying the keys makes the sealed data unreadable.
How Encryption and your own key works →
app.xevrion.co.uk / settings / encryptionExample data

Encryption at rest

Review data
Status
On
Data key
Own key for your organisation
Algorithm
AES-256-GCM
Key held by
Your key service (Enterprise)

Wrap, store, read

  1. Fresh data key per organisation
  2. Key wrapped by your key
  3. Payloads stored encrypted
  4. Destroy the key to erase

Stored value

payload: enc1.k_4f2e.7a9f…c2.0d41…e9b6// prefix, key id, nonce, ciphertext// opened only with your key

Control

SSO, SCIM and roles

Sign in with your own identity provider, provision people automatically, and give each role only what it needs.

  • Single sign-onOIDC with your identity provider. Reviewers use the account they already have.
  • SCIM provisioningPeople are added and removed from your directory, not by hand.
  • Custom rolesDefine who can decide, at what risk level, and who can change settings.
How SSO, SCIM and roles works →
app.xevrion.co.uk / settings / peopleExample data

People

Synced from your provider
  • Priya N.priya@acme.exampleReviewer
  • Sam O.sam@acme.exampleReviewer
  • Mia K.mia@acme.exampleAuditor
  • Dan R.dan@acme.exampleOwner

What each role can do

RowDecideEdit policyExport
Reviewer
Auditor
Policy author
Owner

Leaver in your directory

  1. Removed in your provider
  2. Access ends here too
  3. Open reviews reassigned

Control

Policy Gauntlet

Fire look-alike actions, missing fields and odd numbers at your policy. Get a grade, the exact gaps, and saved tests you can run on every change.

  • Finds the gaps you did not think ofText where a number should be, a missing field, an action name with a space or a capital letter.
  • A grade and a fix for each gapEvery finding says what got through and what to change.
  • Policy tests as codeSave the cases as a file, then re-run them on a draft to see which answers change.
How Policy Gauntlet works →
app.xevrion.co.uk / policies / refunds / testExample data
GradeB212 cases fired
Gaps found3Each has a fix
Passed209As expected

Gaps

  • Amount missing, treated as £0Auto-approved
  • £500.01 not handled by any ruleFalls to default
  • Negative amount acceptedFalls to default

Saved as a test

- name: missing amount  input: { action: refund.issue }  expect: require 2 reviewers

Know what your agents did.

Start free. Guard your first agent in a few minutes, and keep a record anyone can check.

Get started freeSee pricing →
  • Free plan, no card
  • Signed, chained decisions
  • Checked offline, without us