The control layer for agents that take real action.
Run agents against your code, data, tools and workflows — and bind every run to policy, checkpoints, approvals and receipts before any side effect becomes real.
Every other tool watches the agent.
BeforeWire sits on the wire — and holds the action until policy says go.
A side effect is damage the instant it crosses the wire. So the decision can't happen after — it has to happen before: every action is graded by risk and handled before its effect is irreversible — gated, made retry-safe, or compensated. That one inversion is the whole company.
Agents stopped answering. They started acting — and an action can be damage that already happened.
The jump from reading to acting removes the human safety net that used to sit between a model's mistake and the real world. The visible failures are already alarming. The invisible ones are worse.
rm -rf wiped a developer's entire home directory — desktop, docs, keychain.
2025-12
The common thread: write access plus a false "done" — even the latest frontier models.
On tasks a human needs >4 hours for, model success rate is under 10%. Reliable task length doubles only ~every 7 months.
More steps → per-step error compounds → near-exponential decay. [arXiv:2505.05115]
Failures hide behind a fabricated success. Even with the full trace, auto-locating the step that broke hits only ~14%.
Root cause of OpenClaw: context compaction dropped the "confirm first" rule.
A visible mistake you can still patch. The invisible one — by the time it surfaces, the damage is done, amplified, and you can't locate it.
Teams want to deploy. Almost none can govern it yet.
The gap between "willing to use" and "safe to hand the keys to" is exactly where a control layer belongs. Today's tools each cover one slice — none decides whether this write should take effect.
agentic AI within 2 years
for agent governance
One control plane — every action, handled by its risk.
Not every action is equal, so not every action gets the same treatment. BeforeWire grades each one by reversibility × blast radius and routes it accordingly — and whatever the path, every executed action leaves a receipt.
Search, read, draft. No gate, no checkpoint.
Reversible writes; safe to rerun without duplicate effects.
Refund, transfer, delete, send. Human approval first.
Reversed with a forward business action, not a rollback.
A line of depth, not a checklist.
Four pillars, each cutting the load on the next — so the right treatment reaches every action, even through crashes and multi-day waits.
Gate before the effect
HITLProblem. An irreversible effect can't be clawed back — the money's gone, the email's sent. So you stop it before, not after.
Design. A code-level, deterministic interrupt the orchestrator enforces — not a “remember to ask” line in the prompt that one sentence can jailbreak. Only dangerous actions are gated; reads pass. Timeout defaults to deny.
Idempotent retry
keysProblem. Agents and orchestrators retry aggressively. A network blip reruns the step — without protection, one refund becomes two.
Design. Every side-effecting call carries a deterministic key from business identity — refund:{ticket}:{charge}, never a random uuid — passed through to the provider's idempotency (Stripe Idempotency-Key). The server dedupes.
Explicit compensation
sagaProblem. External APIs have no ROLLBACK. “Undo” isn't restoring a snapshot — it's a real, forward, business-meaningful reverse action.
Design. Each forward action is paired with a compensator (refund ↔ recharge, hold ↔ release); on failure, unwind LIFO. Truly irreversible steps are flagged and scheduled last.
Durable orchestration
durableProblem. The first three crash too. HITL may wait days — the process restarted. A compensation chain dies mid-unwind — who finishes it?
Design. A durable-execution engine persists every step and result, recovers exactly after a crash, and drives retries and compensation to the end. Multi-day waits survive restarts and burn no compute.
Gate cuts what needs compensating → idempotency makes retries safe → compensation handles what already happened → durable execution keeps all three reliable under failure.
A coding agent opens a PR — held at every effect.
This is usually where a team starts. A coding agent may read, edit code and run tests freely — but installing dependencies, pushing branches and creating the PR are real side effects, so they enter the controlled path first. The same path later covers data writes, refunds and deploys.
Policy bound
Allowed paths, commands, a network boundary and approval thresholds — set before the run.
Checkpoint
Files and lockfile become recoverable state; the agent edits and tests freely.
Held at the gate
Installing deps and creating the PR are real effects — so they wait. Nothing remote yet.
Approved
A required check clears and a human approves what policy flagged.
Executed + receipt
The broker runs the action, then emits a signed receipt to a GitHub Check.
The agent still completes the work. It just no longer installs dependencies or creates the PR silently — and the team defined which paths are automatic, what needs approval, and what is blocked.
* Restore figure from the ForkCell public benchmark. This walkthrough illustrates the controlled-run model, not a live production capture.
Every action leaves an Action Receipt.
Not a log line you have to trust — a signed, independently verifiable record of what was allowed, under which policy, against which checkpoint, approved by whom. The audit trail writes itself.
- → Tamper-evident: hashed and chained
- → Maps the effect back to the policy decision that allowed it
- → Flows into the PR, ticket and audit chain
Start free and local. Grow into team governance.
What's live today: the ForkCell open-source core. The shared team control plane is in early access and rolling out — the runs shown above illustrate the model.
The person who has to say “yes” finally can.
Policy is enforced at the wire, not promised in a doc. The blocker becomes the approver.
Recoverable work checkpoints; irreversible work waits for a gate. No silent, unlocatable damage.
Receipts are the evidence. Export the chain instead of reconstructing what an agent did from scattered logs.
Give agents production access — without giving up control.
Bring one action you'd never let an agent do unsupervised. We'll map it into a controlled run — policy decision, checkpoint, approval gate and a signed Action Receipt — so your security team can see exactly what they're saying yes to.