WATER Agentic is coming soon.

WATER Agentic Governance

Coming soon

Every agent action allowed, checked and recorded, or it doesn't happen.

Governance is the single place that decides what agents may do and proves who is asking. Registry, policy, identity, guardrails, kill switch and evidence, all data driven and default deny, sold and tested on its own.

What it does

A. Know every agent: registry

Available
  • Four separate registries (tool servers, tools, skills and agents) joined only through capabilities.
  • An agent gets a tool only because one of its skills needs that capability, at the agent's current process stage.
  • Every agent has an owner, a risk tier, a budget and a status.
  • Every tool has a risk class and an approved fingerprint.
  • A new tool a server starts offering is hidden and refused until someone approves it.
  • If a server changes a tool's name, description or schema after approval, the tool is suspended automatically until it is approved again: protection against tool tampering and "rug pull" changes.
  • Explain any decision: for any agent and tool, see the decision and the path through skills and capabilities.

B. Decide every call: policy engine

Available
  • Default deny: anything not explicitly allowed is refused, including unknown agents and missing fields.
  • A decision before every tool call, every model call that costs money and every memory write.
  • Skill allowlists per process stage.
  • Policy as code: versioned, tested and published from the registry in one step.

C. Prove who is asking: identity and access

Available
  • Single sign on for people; a separate identity for every agent.
  • Tools learn whom they serve only from a verified token, never from what an agent claims.
  • Restricted tier: sensitive tools accept only tokens issued for them.
  • Rule of Two: high impact actions need a second person.
  • Secrets are kept in a managed vault, never in agent code.

D. Check every word: guardrails

Available
  • On the question: prompt injection and jailbreak detection, toxicity, restricted topics, invisible text stripping, personal data redaction.
  • On tool results: content that tries to instruct the agent is flagged before the agent acts on it.
  • On the answer: personal data and secrets are redacted before anyone sees them.
  • On images: type, size and count limits, and a check for instructions hidden in images.
  • Fail safe: if the checking model is unavailable, the request is blocked, not passed.
  • Tighten only: workspaces and agents can make checks stricter, never looser.
  • UK aware personal data: National Insurance numbers, NHS numbers, sort codes and account numbers, postcodes, card numbers, IBANs, email addresses and more.

E. Stop anything at once: kill switch and spend control

Available
  • Pause any agent instantly from an admin page or command line. It is refused for every action and its model keys are blocked.
  • Who paused it and why is recorded; resume just as fast.
  • Per agent model budgets and daily spend limits, set by the owner.

F. Contain execution: sandbox

Available
  • Code and tools agents run are isolated, with resource limits, from a pinned image.

G. Govern memory

Available
  • A policy decides before anything is remembered; personal data is masked first.
  • Retention periods and purge on request, supporting the right to erasure.

H. Keep a human in charge

Available
  • Agents ask for confirmation before actions with consequences.
  • Human review tasks, queues and SLA deadlines in the work console.

I. See everything: audit and traceability

Available
  • Every policy decision is logged and shipped to the audit store.
  • Every agent turn is traced: model, tools, cost and time.
  • Roadmap: audit store schema and retention rules per framework.Roadmap

J. Release with evidence: evaluation

Roadmap
  • One evaluation engine for the whole suite: test packs per agent, domain and solution.
  • Regression gates that block a release that scores worse than the last.
  • Scorecards and trends per agent, skill and model.
  • A guardrail red team suite.

K. Explain and assure

Roadmap
  • Reviewers see the rationale, evidence and confidence behind a decision.
  • What if simulation of a policy before rollout.
  • Risk tiering, model cards and impact assessments that decide the controls an agent needs.
  • Fairness and bias checks and continuous compliance monitoring.
  • Full tenant isolation across every store.

The control chain.

01

Person or channel

02

Identity check

03

Guardrails on the question

04

Agent plans

05

Gateway: token + policy decision

06

Tool acts

07

Guardrails on the tool result

08

Guardrails on the answer

09

Decision log

Who it is for

CISO

one control point for every agent, tool and model call.

Risk and compliance

decision records and mapped controls on demand.

Model risk

an inventory of every agent with risk tier, owner and evaluation.

Data protection officer

personal data detection, masking, retention and erasure.

Works with the rest of the suite.

WATER Agentic Platform

Where agents run.

  • One runtime for every agent and channel
  • Shared behaviour declared in settings, not code
  • Memory, models and human workflow built in
Learn more

WATER Agentic Tools

Agents that act.

  • Ready tool servers on the open MCP standard
  • Swap the system behind a tool by settings
  • Every call checked before it runs
Learn more

WATER Agentic Industry Solutions

Agents for your domain.

  • HR operations first, insurance next
  • Shared domain knowledge reused by every agent
  • Connects to your systems of record
Learn more

Frequently asked questions.

Can an agent ever call a tool it was not approved for?

No. Unapproved tools are hidden and refused, and a policy decision is required for every call.

What if a tool changes after approval?

It is suspended automatically until it is approved again.

Can a business unit relax a guardrail?

No. Workspaces and agents can only tighten them.

How fast can we stop an agent?

Immediately, from the admin page; it is refused everywhere.

What happens if the checking model is down?

Requests are blocked rather than passed unchecked. ---

COMING SOON

Governed agents are coming.
Get in early.