Your AIs need supervision too

The risk isn't science fiction. It's software holding production credentials.

Agents are being wired into the same systems your employees use — often with a single broad API key and no checkpoint between what the model decides and what the system executes. Your employees have permissions. Your AI agents should too.

Payments

Refunds, payouts, credits and subscription changes executed on a model's judgment.

payments.refund → payment:pi_…

CRM

Contact updates, pipeline changes and bulk edits across customer records.

salesforce.contacts.update

Databases

Reads that turn into writes, deletes and migrations against live data.

records.modify → table:orders

Internal APIs

Admin endpoints and service-to-service calls that were never designed for autonomous callers.

accounts.suspend → user:8841

MCP tools

Every MCP server added to an agent is a new set of tools it can call without asking.

github.merge_pull_request

Email

Outbound messages to customers, vendors and anyone else an agent decides to contact.

email.send → destination:external

File systems

Shared drives, buckets and repositories — including the restricted data inside them.

files.export → data_class:restricted

Business workflows

Approvals, provisioning and order flows where one wrong step has real consequences.

orders.cancel → order:SO-20931

Typical agent access today

One long-lived key with broad scopes
No record of which agent did what, or why
No checkpoint before high-impact actions
Revoking access means rotating everything

With Mother AI

A stable identity for every agent
Least-privilege policies evaluated on every action
Human approval where the stakes require it
An evidence trail for every decision

How it works

Mother sits between the request and the action.

Your agent, chatbot or MCP client asks Mother before it executes anything protected. The gateway identifies the caller, the policy engine decides, and only an explicit ALLOW reaches your tools.

Agent · Chatbot · MCP client

Describes the action it intends to take — then waits for Mother's answer.

POST /v1/evaluate POST /v1/mcp/evaluate
Mother AI Gateway

Authenticates your organization's API key, resolves the registered agent and its environment, and normalizes the request.

agent_id · capability operation · resource
Policy engine

Evaluates every enabled policy in scope with fixed precedence. Deterministic — no model decides.

block > review > allow > default
Decision

ALLOWREVIEWBLOCK

Returned with a reason code and written to the audit trail before the response leaves Mother.

decision_id reason_code
Approved tool / API

Runs only on ALLOW, or after a REVIEW is approved and its one-time grant is consumed. Anything else: it never runs.

payments · CRM · database internal API · MCP tool

REVIEWpath

When a decision needs a human

AI requests the action An agent asks to refund a payment above your approval threshold.
Mother pauses it The decision is REVIEW. An approval request is created with a short expiry.
A human approves or rejects In the Mother console approval queue, by a member with approver rights.
The decision is recorded Approval events are appended. The original decision is never edited.
Execution continues or stops Approved — the integration consumes the one-time grant, then executes. Rejected or expired — the action never runs.

Fail closed, by design

Invalid key, disabled organization, unknown agent, malformed policy or an evaluation error all resolve to BLOCK with a reason code. Mother never allows an action because something went wrong.

The decision contract

Three answers. No ambiguity.

Every evaluation returns exactly one decision and a machine-readable reason code. Integrations treat anything other than ALLOW as “do not execute”.

ALLOW

Policy permits the action.

Your integration: Executes the action.
Reason codes: POLICY_ALLOW
DEFAULT_ALLOW^*

^*Only for non-production agents set to default to allow.

REVIEW

Human approval required before execution.

Your integration: Holds. Checks the approval, consumes it once, then executes — or stops.
Reason codes: HUMAN_APPROVAL_REQUIRED
DEFAULT_REVIEW

Approvals expire. Expired or rejected requests never execute.

BLOCK

Policy denies the action.

Your integration: Does not execute.
Reason codes: POLICY_BLOCK · DEFAULT_DENY
AGENT_UNKNOWN · POLICY_INVALID

Errors fail closed: every failed gateway response also carries "decision": "block".

Live interactive demo

Send a request. Watch the policy engine decide.

This runs the production Mother AI policy engine against a fixed demo workspace. Pick a scenario or edit the request — the decision, the reason and the policy that fired come straight from the engine.

Scenarios

Loading demo workspace…

Agent Capability Operation Resource Destination Data class context.amount optional, numeric

Choose a scenario and evaluate it. The decision appears here.

—

— Round trip, measured in your browser

reason_code: —
reason: —
policy: —
evaluated: —
engine: —

Matched policies

Demo unavailable

The demo workspace could not be reached. Please try again shortly.

POST /api/demo/evaluate

{}

// Evaluate a request to see the response

Identity & permissions

Permissions for actions, not filters for prompts.

Mother doesn't read prompts. It evaluates the concrete action an agent is about to take — who is asking, what it wants to do and to what — against the policies your organization configured.

Who is asking: agent registered agent ID · environment production, staging or development — bound to the agent · organization API key, where test keys can't act for production agents
What it wants to do: capability operation protocol api or mcp mcp.server mcp.tool
To what: resource destination data_class
In what context: context.* any value your integration sends — an amount, a ticket, the initiating user or service

Unregistered or disabled agents fail closed. Mother has no separate end-user identity field: pass the initiating user or service in context and write policies on context.*.

Billing Agent

billing-agent-prod

Active

Environment: production
Default mode: block
Bound policies: 3
Gateway key: mai_live_7Qf2…

Policies

ALLOWRefunds up to threshold
REVIEWHigh-value refunds require approval
BLOCKRestricted data egress

Example agent. Keys are shown by prefix only — Mother never stores raw keys.

Policy enforcement

Deterministic rules your security team can read.

Build policies visually from the fields Mother evaluates. Same request, same policies, same decision — every time. No language model decides whether a protected operation is permitted.

High-value refunds require approval

priority 20 · scope: billing-agent-prod · v3

IF capabilityequalspayments

AND operationequalsrefund

AND context.amountgreater_than1000

THEN REQUIRE HUMAN APPROVAL

Preview against sample requests

payments.refund · amount 4200REVIEW
payments.refund · amount 180NO MATCH
payments.refund · no amountREVIEW

fields agentenvironmentprotocolcapabilityoperationresourcedestinationdata_classmcp.servermcp.toolcontext.*

Precedence

1BLOCKAny matching block policy wins.
2REVIEWOtherwise, any matching review policy holds the action.
3ALLOWOtherwise, a matching allow policy permits it.
4DEFAULTNothing matched: the configured default — deny unless you choose otherwise.

Priority decides which policy is reported when several of the same effect match — it never lets an allow override a block.

Operators

equalsnot_equalsinnot_instarts_withglobgreater_thangreater_than_or_equalless_thanless_than_or_equalexistsnot_exists

Read-only research

research-agent-prod

Allow knowledge.read and records.read. Block records.modify and anything under finance.

High-value finance

billing-agent-prod

Allow refunds under the threshold. Above it, review — a human approves before execution.

Restricted-data egress

All agents

If data_class = restricted and destination = external, block. No exceptions by prompt.

MCP governance

Every MCP tool call is an action. Treat it like one.

The Model Context Protocol makes it trivial to hand an agent new tools. Mother understands an MCP tool call — server, tool, arguments, calling agent and organization — and normalizes it into the same canonical request as any other action, so one policy set governs both.

MCP tool call

"server": "salesforce",
"tool": "contacts.update",
"arguments": {
  "contact_id": "003Hx…",
  "email_opt_out": true
}

Canonical Mother request

"agent_id": "sales-agent-prod",
"protocol": "mcp",
"capability": "salesforce",
"operation": "contacts.update",
"resource": "contact:003Hx…",
"context": { … }

before-tool-call.ts

// Ask Mother before your MCP client executes a tool call.
const res = await fetch("https://api.mother.proptechusa.ai/v1/mcp/evaluate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.MOTHER_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    request_id: call.id,
    agent_id: "sales-agent-prod",
    server: "salesforce",
    tool: call.name,
    arguments: call.arguments,
  }),
});

const verdict = await res.json();
// Fail closed: anything but an explicit allow is a no.
if (!res.ok || verdict.decision !== "allow") {
  return refuse(verdict.reason_code, verdict.approval_id);
}
return executeTool(call);

Today

Mother is the policy decision point your MCP client or server calls before executing a tool. Transparent MCP proxying is on the roadmap — we'll say so when it ships, not before.

Human approval

When the stakes are high, a person says yes.

REVIEW is a real hold, not a warning. The action waits until an authorized approver decides — and the integration can only execute once, before the grant expires.

1
AI requests a protected actionYour integration calls /v1/evaluate or /v1/mcp/evaluate.
2
Mother evaluates policyEvery enabled policy in scope, with fixed precedence.
3
Decision becomes REVIEWAn approval request is created and expires if nobody acts.
4
An approver reviews it in the consoleWho is asking, what it wants, why Mother stopped it and which policy fired.
5
Approve or rejectWith an optional note. Only members with approver rights or higher can act.
6
Mother records the decisionApproval events are appended. The integration checks /v1/approvals/{id} and consumes the grant once before executing.

Approval required 14:32

billing-agent-prod

production · requested 12:04:31 UTC

Wants to

payments.refund

$4,200.00USD

payment:pi_3Qx…9Lk

Why Mother stopped it: Refund amount exceeds the 1,000 approval threshold.
Policy: High-value refunds require approval · v3
Reason code: HUMAN_APPROVAL_REQUIRED

Example approval card

Audit trail

Know exactly what every agent tried to do.

Every evaluation becomes evidence: agent, capability, operation, resource, policy, decision, reason and timestamp — in a tamper-resistant, append-oriented audit trail. There is no API for rewriting history.

Example events

12:07:52

BLOCKsupport-agentfiles.exportbucket:exports/customers.csv

RESTRICTED_DATA_EGRESS · Restricted data egress · destination external
12:06:10

APPROVEDj.riveraapprovedapr_8XkQ…

Approval event recorded · original decision dec_4Jm2… unchanged
12:04:31

REVIEWbilling-agent-prodpayments.refundpayment:pi_3Qx…

HUMAN_APPROVAL_REQUIRED · High-value refunds require approval · amount 4200
12:02:18

BLOCKresearch-agent-prodrecords.modifyrecord:acct_2291

OPERATION_NOT_ALLOWED · Research agent is read-only
12:01:44

ALLOWresearch-agent-prodknowledge.readdoc:pricing-faq

POLICY_ALLOW · Research agent read access
11:58:03

POLICYa.chenupdatedHigh-value refunds require approval → v3

Control-plane change recorded with the new policy version

Every decision record includes

decision
reason_code
reason
agent
capability
operation
resource
destination
data_class
environment
protocol · MCP server/tool
policy + version
matched policies
redacted context
request_id
decision_id
API key prefix
engine version
timestamp

Reviews add approval status, approver, note, expiry and one-time consumption as separate events.

Credential-like fields in context are redacted before storage Approvals and policy changes are separate events Filter by agent, decision, capability, environment and date

Mother AI Protected

Make your AI controls visible.

Your customers are asking what your AI agents can do with their data. Show them. Organizations with live Mother AI controls can display a dynamic Mother AI Protected badge that links to a public verification page — served live from Mother, so it can't outlast the controls behind it.

Example badge

MOTHER AI PROTECTEDAI Controls Active

Badge status is live

ACTIVEAll controls configured and enabled.
SETUPControls not yet fully configured.
SUSPENDEDControls were disabled after activation.
REVOKEDBadge withdrawn. Never renders green.

embed.html

<a href="https://mother.proptechusa.ai/verify/TOKEN">
  <img src="https://api.mother.proptechusa.ai/badge/TOKEN.svg"
       alt="Mother AI Protected — AI Controls Active">
</a>

Mother AI Protected

Organization: Acme, Inc.
Status: ACTIVE

Agent identity configured
Policy enforcement enabled
Human approval capability enabled
Audit logging enabled

Last verified · live at page load

Example verification page for a fictional organization.

Earned by configuration, not by signing up

The badge only turns active when every requirement is met — and it changes state automatically when they aren't.

Organization active
Gateway enabled
Audit logging enabled
At least one active agent
At least one enabled policy
An active production API key

Mother AI Protected indicates that this organization has configured and enabled Mother AI agent access controls. It is not a certification of the organization's entire cybersecurity program or a guarantee against security incidents.

Founding Access

Put your agents behind Mother.

Mother AI is in early access. The gateway and policy engine are live; some enterprise integrations are still rolling out. Founding teams work directly with the people building it.

Real enforcement from day one. Agent registry, policies, approvals and audit on the production gateway.
Shape what ships next. Integration and MCP priorities are set with founding teams.
Straight answers. We'll tell you what Mother does today and what it doesn't.

Prefer to talk it through first? Book a conversation (opens Calendly in a new tab)

Name Company Work email What do your agents do, and what do you need to control? Approximate number of agents Do you use MCP?

Your AI has permissions. Mother enforces them.

The risk isn't science fiction. It's software holding production credentials.

Payments

CRM

Databases

Internal APIs

MCP tools

Email

File systems

Business workflows

Mother sits between the request and the action.

Agent · Chatbot · MCP client

Mother AI Gateway

Policy engine

Decision

Approved tool / API

Fail closed, by design

Three answers. No ambiguity.

ALLOW

REVIEW

BLOCK

Send a request. Watch the policy engine decide.

Permissions for actions, not filters for prompts.

Deterministic rules your security team can read.

research-agent-prod

billing-agent-prod

All agents

Every MCP tool call is an action. Treat it like one.

When the stakes are high, a person says yes.

Know exactly what every agent tried to do.

Make your AI controls visible.

Earned by configuration, not by signing up

Put your agents behind Mother.

Request received.