Write the rules once. Everyone works inside them.

Roles, access, checks, authority and escalation for every agent you buy or build, and every person. Set before any work starts. Applied on every step, not on paper.

Own login per agentMaker and checker differEscalation by impactOne switch

Book a demo Experience now

Bought and builtSame stop switch, budget and recordSAP JouleLangGraphClaims agent

Whole agencyDefaults set once, used by every new agent

Refunds above 50K need a person
No agent sees payroll

Each agent · Claims agentWhat it may do alone, when it must ask, what it must never do

Approves alone up to 200K
Asks Priya Nair above that
Never changes a scheme

Rules inherit inwards · example

The problem

A policy document is where governance starts. Not where it ends.

One team builds agents on LangGraph. Another buys a vendor bot. Approvals happen in someone's inbox, and tools get wired in by whoever built the agent. Nobody can say what the rules are across all of it.

Governance works only when it runs inside every task and every decision, every day.

The Intelligent Enterprise series

What you get

Did it work the way I asked?

One set of rules, wherever the agent was built

Agents from LangGraph, CrewAI, ServiceNow and 30+ other platforms run under your rules. Replies from outside agents are read as data, not orders.

Its own login, its role's access

Every agent gets its own login, never a shared one. It reaches only the systems, actions (view, create, change, approve) and data its role needs.

No one checks their own work

Maker and checker are never the same. A judge grades every run, and templates end with an audit agent.

Authority earned from the record

An agent's limit widens only when its record earns it. Mistakes narrow it again. A vendor update never widens it.

Escalation by complexity and impact

Team member, then manager, then senior leaders. If someone doesn't reply in time, it moves to the backup you named.

One switch stops everything

Pause the whole operation across every server, work in progress included. It holds through a restart.

Rules at three levels

One control room. Different rules per agent.

A refund agent and a hiring agent should never have the same permissions. One decides about money. The other decides about a person.

Each agentWhat can it approve on its own? Above what amount must it ask a person? What must it never do?
Each agent typeAgents doing the same job start from the same rules. Every new agent of that type inherits them.
Bought and builtYour vendor's agent and your own agent follow the same rules, from the same place.

Bought and builtSame stop switch, budget and recordSAP JouleLangGraphClaims agent

Whole agencyDefaults set once, used by every new agent

Refunds above 50K need a person
No agent sees payroll

Each agent · Claims agentWhat it may do alone, when it must ask, what it must never do

Approves alone up to 200K
Asks Priya Nair above that
Never changes a scheme

Rules inherit inwards · example

Earned authority

Authority is earned on evidence, not trust.

Like a new employee, an agent starts by advising. As the record shows clean work, its limit widens. When the record shows mistakes, the limit narrows. Every change is recorded with the reason.

Claims agent · limitsSet by you, from the record

1 · AdvisesA person decides every caseEvery claim goes to a personWeeks 1–4

Now2 · Decides up to a limitAbove it, a person decidesAlone up to 200KAfter a clean record

3 · Higher limitWhen you raise itUp to 500KOnly if you change the rule

after a mistake

Tasks per week, from the record

you narrow it after mistakes · it stays until you change it · example

Authority · Claims agentEarned one task at a time, from the record

Level 2 of 4

Checked tasks with no override, last 12 weeksTrack record improving

AdvisesA person decides every claim

Done

Decides alone up to a set amountAbove it, recommends and a person decides

Current

Higher limitUnlocks when the record meets your bar

Locked

Mistakes in the record narrow the limit again. A vendor update never widens it.

Product screen · example dataLeafCraft console

Escalation

Silence is never a yes.

Escalation goes to named people, by complexity and impact. It is not a ticket queue. If the right person doesn't reply in time, the work moves to the next one you named. Nothing is paid, sent or changed while it waits.

Claim C-20418420K · North region

03Senior leadersAbove 2.5M
The largest or riskiest calls. Nothing is lost on the way up.
02ManagerUp to 2.5M
Higher value or more complex, as your rule sets out.
Reply within 4 hours · silence is never a yes
01Team memberUp to 200K
The named person for this kind of case. Routine exceptions stop here.
Above this limit · passed up with the reason

One claim · example

Escalation pathBy complexity and impact. Named people, clear thresholds.

Edit

Team member · Priya Nair · Sales financeAbove the agent's limit, or a rule is unclear

Waiting

Manager · Rahul Mehta · Head of sales financeHigh value, or no reply in 4 hours

Backup set

Senior leaders · CFO officeVery high value, or a new kind of risk

Backup set

Silence is never a yes. If no one replies in time, the work moves up the path. Nothing is paid, sent or changed while it waits.

Product screen · example dataLeafCraft console

How it plays out

One invoice, start to finish.

An invoice comes in, and the invoice agent checks it against the purchase order.
The amount is above the agent's earned limit, so your rule sends it to the controller.
The controller is on leave and doesn't reply in time. It moves to the backup reviewer you named.
The backup approves it with a reason, and the invoice is posted to your ERP within the agent's budget.

LeafCraftto Priya Nair, Sales finance manager · 10:42

Invoice above the agent's limit

ItemINV-55120 · Supplier paymentWhy youAbove the agent's limitAgent saysApprove. Matches the PO and the goods receipt.WaitingMoves to Rahul Mehta, Head of sales finance, in 4 hours

Your reason (required): "Scheme confirmed with the regional team."

ApproveSend backReject

Your reason is saved in the record, next to the agent's reason.

Decision request in Microsoft Teams · example dataLeafCraft console

Questions teams ask

Can a model overrule the route?

No. Routes are plain conditions checked by code, the same way every time.

Do outside agents follow the same rules as ours?

Yes. They are routed, signed off, budgeted and recorded the same way. They get only the fields you choose and reach only the addresses you allow.

How is access removed?

Access is set per role. When a role or an agent ends, its login and access are removed the same day.

How are replies from an outside agent handled?

Replies from outside agents and tools are read as data, not orders.

Discover every agent

You can't govern what you can't see.

LeafCraft connects to your ecosystem and finds every agent you run: the ones vendors shipped inside your software and the ones your teams built. Then each one gets an owner, comes under your rules, or is removed.

Shadow AI endsEvery agent ownedUnwanted agents removedMemory starts from day one

How discovery works

Inside software you buySwitched on by vendor updates

CRMERPHR systemService deskOffice suite

Built by your teamsPilots, scripts and side projects

LangGraphCrewAINotebooksAutomationsCopilot studios

LeafCraft connects to your ecosystem and finds every agent

One registerexample counts

23found

9no owner yet

11governed

3retired

Bring the process you're scared to automate.

We'll show you where the roles, limits, sign-offs and the off switch go.

Book a demo Experience now

Write the rules once. Everyone works inside them.

The problem

A policy document is where governance starts. Not where it ends.

What you get

Did it work the way I asked?

One set of rules, wherever the agent was built

Its own login, its role's access

No one checks their own work

Authority earned from the record

Escalation by complexity and impact

One switch stops everything

Rules at three levels

One control room. Different rules per agent.

Earned authority

Authority is earned on evidence, not trust.

Escalation

Silence is never a yes.

How it plays out

One invoice, start to finish.

Questions teams ask

Discover every agent

You can't govern what you can't see.

Explore the rest of the platform

How it works

Discover every agent

One team

Your memory

Your budget

Bring any agent

Security and deployment

Bring the process you're scared to automate.