Let software act. Keep a human on the decisions that matter.
Before an AI agent, workflow or internal tool does something risky, it asks Orbis. Deterministic policy decides in milliseconds; high-impact actions go to a verified human on iPhone; every decision comes back with a signed receipt.
This is the production policy engine running in your browser on the default Northstar policy pack.
Authentication proves who logged in. It doesn't say whether this action is OK right now.
Agents send email, move money, deploy, export data and grant access — not just recommend.
Every app builds its own approve button, so governance and audit fall apart across systems.
Block everything and automation is useless. Allow everything and autonomy is dangerous.
One question before every risky action: may I do this?
Orbis sits between software intent and execution. Safe work stays automatic; only genuinely ambiguous or high-impact actions reach a person.
Your app, agent or workflow calls preflight with actor, action, resources, destination and intent — redacted, never raw payloads.
Versioned, deterministic policy returns allow, warn, deny or approval_required in milliseconds. No LLM in the enforcement path.
High-impact actions go to the right human's iPhone with evidence, blast radius and a safe alternative. Face ID when policy says so.
Your code executes only what was authorized, reports the outcome, and keeps an Ed25519-signed receipt anyone can verify.
This is the real policy engine. Push it.
Change the action, the data class, the destination or the context and watch the same deterministic engine that runs the gateway decide — with the exact rule and risk factors behind every answer.
- Sensitive data leaving the trust boundary+30
- New or untrusted destination+15
- Hard to reverse once executed+10
Not a tiny admin dashboard. A trusted decision terminal.
Native SwiftUI. Understand any decision in five seconds — what, who, why, risk — then approve, edit, redirect or reject with Face ID.
Action verb first, actor, intent, risk with reasons — evidence progressively disclosed.
LocalAuthentication proves presence on a registered device. The server still verifies assignment, state and expiry.
Redirect to the private model, pay a $1 verification deposit, issue a service credit — not just yes or no.
Control tab freezes a misbehaving agent; every next gateway call is denied until an admin restores it.
Notifications carry a title and a deep link. High-risk approvals never complete from a notification.
Share a link, scan a QR, or select a screenshot and get an explainable verdict before you click or pay.
Interactive — tap “Redirect safely”.
SwiftUI, Keychain, LocalAuthentication and deep links — running against the same live gateway as this site. Unedited simulator captures.
One reusable decision layer for every system that can act.
Build one generic integration, not fifteen bespoke approval screens. These all run in the Northstar Cloud demo tenant today.
Procurement agent sends confidential contracts to an unapproved model → paused, redirected to the private LLM.
$84,000 to a vendor created two days ago with a fresh bank change → controller + Face ID.
AI refund of $8,500 after an outage → manager edits to the contractual $8,160 and approves.
Hotfix outside the change window during an incident → on-call sees diff, tests, rollback, blast radius.
30-minute DB admin → manager approval, step-up, auto-expiry and a receipt.
Bulk export of 120k customer records → blocked by default; exception needs data owner + security.
Agent emails non-public pricing → sales leader approves or auto-redacts restricted sections.
Release of patient records to a partner → privacy officer, purpose and scope logged.
Maintenance AI recommends stopping a chiller line → site manager sees sensors and a reduced-load alternative.
Employee scans a parking QR or forwards a “CEO” text → explainable verdict before anyone clicks or pays.
An agent's volume spikes 14× → one tap on iPhone freezes it; the gateway denies every next call.
Preflight API, Approval API or observe-only events — start with visibility, graduate to enforcement.
Read the docsA model that can ask for a human.
Missed v1? Watch the original launch film (40 s).
Fifteen minutes to the first protected action.
TypeScript, Python and Swift SDKs. Typed envelopes, idempotent requests, webhook signatures, and an SDK that never executes your action for you.
const decision = await orbis.preflight({
actor: { type: "agent", id: "procurement-agent" },
action: { type: "external_send", tool: "llm.summarize" },
resources: [{ type: "document", classification: "confidential", count: 4 }],
destination: { type: "external_model", value: "quickscribe-ai.app" },
intent: { reason: "Summarize vendor contracts for RFP" },
});
if (decision.isAllowed()) await execute();
else if (decision.requiresApproval()) {
const final = await decision.waitForResolution({ timeoutMs: 600_000 });
if (final.approved) await execute(final.approvedParameters);
}Preflight before acting, explicit Approval API, or observe-only events to start with visibility.
Wrap tool calls once; denials surface to the agent as errors it can reason about. Safe redirects re-plan automatically.
Idempotency keys, retries with backoff, HMAC-signed webhooks with replay windows, SSRF-safe callbacks.
Audit logs say “approved.” Receipts prove it.
Every final decision produces a receipt bound to the exact policy version, evidence hash, approver, device step-up and downstream outcome — signed with Ed25519. Verify this real one from the demo tenant right here, then try tampering with it.
Independent verification
Runs in your browser with WebCrypto — no trust in this server's word required.
{
"receipt_id": "rcp_SxTWBDeOaYb9",
"revision": 2,
"tenant_id": "ten_northstar",
"decision_id": "dec_OgM2qabxye0V",
"action_id": "act_yuJhjaM91l9x",
"request_id": "req_hero_mvdnmf40",
"issued_at": "2026-10-18T10:01:01.000Z",
"caller": {
"integration_id": "int_procurement",
"integration_name": "Procurement Agent"
},
"actor": {
"id": "procurement-agent",
"type": "agent",
"owner": "finance"
},
"action": {
"type": "external_send",
"tool": "llm.summarize",
"title": "Send 4 contracts to external AI",
"summary": "4 confidential vendor contracts (MSA + 3 SOWs) for summarization"
},
"envelope_hash": "9a21563ddc591d0291bbc1dfa6058da46f26f9af6c503d95cfa8680c4ed7b991",
"policy": {
"id": "pol_conf_external",
"version": 17,
"rule_id": "ext_model_confidential"
},
"policy_versions": [
{
"policy_id": "pol_conf_external",
"version": 17
},
{
"policy_id": "pol_payments",
"version": 9
},
{
"policy_id": "pol_refunds",
"version": 5
},
{
"policy_id": "pol_prod_change",
"version": 12
},
{
"policy_id": "pol_privileged_access",
"version": 7
},
{
"policy_id": "pol_bulk_export",
"version": 4
},
{
"policy_id": "pol_sales_comms",
"version": 3
},
{
"policy_id": "pol_regulated",
"version": 6
},
{
"policy_id": "pol_ops_safety",
"version": 2
},
{
"policy_id": "pol_agent_guardrails",
"version": 11
}
],
"risk": {
"score": 50,
"level": "high",
"reasons": [
"sensitive_external",
"irreversible"
]
},
"enrichment": {
"used": true,
"model": "orbis-edge-risk@1.0.0",
"feature_schema": "edge-features/1",
"policy_version": "1.0.0+cal1",
"source": "local+cloud",
"class": "high_risk",
"risk": 1,
"abstain": false,
"fusion_rule": "deterministic_approval_wins"
},
"decision": {
"status": "approval_required",
"effect": "require_approval",
"final_status": "approved_modified"
},
"approvals": [
{
"user_id": "usr_avery_kim",
"name": "Avery Kim",
"decision": "safe_alternative",
"step_up": "biometric",
"device_id": "dev_avery_kim",
"at": "2026-10-18T10:00:48.000Z",
"channel": "ios"
}
],
"original_parameters": {
"destination": "summarizr.io",
"documents": 4,
"model": "gpt-class external"
},
"approved_parameters": {
"destination": "northstar-private-llm",
"documents": 4,
"model": "gpt-class external"
},
"safe_alternative_applied": "redirect_internal_model",
"timestamps": {
"received_at": "2026-10-18T10:00:00.000Z",
"decided_at": "2026-10-18T10:00:00.011Z",
"resolved_at": "2026-10-18T10:00:48.000Z"
},
"outcome": {
"status": "succeeded",
"reported_at": "2026-10-18T10:01:01.000Z"
},
"prev_hash": "f8c9a57fec9c8253e099b0c66b6a8eb4cf707365679dc6fde8d2fa5e3aa93ef0"
}“Is this safe?” — answered with evidence, not vibes.
Two models trained from scratch on public datasets — a hostname phishing classifier (ROC-AUC 0.91, 271,078 hosts) and a scam-message classifier (F1 0.95) — fused with explainable rules and your company's policy. Only content you explicitly share is analyzed.
Runs the same from-scratch models used in the Orbis iOS app. Nothing you paste here is stored.
Check before you click, pay or reply
A recommendation with evidence and Northstar policy — not a generic chatbot answer.
A model that can ask for a human. Never one that can approve.
Orbis now runs its own trained risk model on the endpoint. It reads metadata only — destinations are hashed on the device — and adds a calibrated signal that can raise an action to review. Deterministic policy still decides.
risky actions escalated on the hand-written gold set
safe actions sent to a human (held-out test)
p95 on-device inference · Core ML on Apple M4 Pro
release gates passed before it could ship
- 01Dataset
33k versioned events · held-out actors & days · immutable gold set
- 02Train & select
rules → logistic → trees → MLP, chosen on a security cost matrix
- 03Gate
recall, false-positive budget, calibration, parity, latency, adversarial
- 04Ship to the Mac
Ed25519-signed manifest → hash check → compile → atomic swap
- 05Operate
drift, review queue, retrain → candidate. Never auto-promotes
Deterministic policy owns enforcement.
AI may summarize evidence, classify intent and recommend. It never silently overrides a hard deny, a threshold, a role requirement or a tenant control.
Tenant derives from the credential — never the payload. IDOR and cross-tenant tests in CI.
Approvals verify assignment, state, expiry and step-up proof before any mutation.
Redacted summaries and classifications. No secrets or raw content in logs, traces or push.
Keys hashed at rest and scoped. Webhooks HMAC-signed with timestamp replay protection.
Hash-chained audit trail and signed receipts with revision chains.
Published versions never change. Drafts are simulated and co-signed by a second admin.
Freeze any actor instantly; pending approvals are cancelled and audited.
Core allow/deny/approval keeps working if every model provider is down.
Priced on protected automation — never per approver.
Platform fee plus decision volume. Usage metering is computed after enforcement and can never change a decision.
- 1 tenant + sandbox
- 3 integrations
- 5k decisions / month
- Basic mobile approvals
- Production gateway
- Policy Studio + simulator
- Audit trail & receipts
- 50k decisions / month
- SSO, advanced routing & quorum
- Analytics & retention controls
- 250k+ decisions
- Priority support
- SCIM, custom region & retention
- Private networking
- Audit export packages
- Dedicated limits & SLA