Control Plane for AI Agents

Your AI has permissions. Mother enforces them.

Identity. Permissions. Human Approval. Audit Trails.

Mother AI sits between your agents and the actions they take. Every protected call — a refund, a CRM update, a database write, an MCP tool — is checked against your policies before it runs, and answered with allow, review or block.

Start protecting agents See how it works

Deterministic decisions
Fail-closed by default
MCP-aware

Gateway POST /v1/evaluate

agentbilling-agent-prod
agentresearch-agent-prod
agentsales-agent-prod
agentsupport-agent

Mother ALLOW

paymentsStripe API
crmSalesforce
databaseorders-db
mcpgithub server
egressexternal API

Illustrative requests. Decisions are made by your policies, not a model.

The actual problem

The risk isn't science fiction. It's software holding production credentials.

Agents are being wired into the same systems your employees use — often with a single broad API key and no checkpoint between what the model decides and what the system executes. Your employees have permissions. Your AI agents should too.

Payments

Refunds, payouts, credits and subscription changes executed on a model's judgment.

payments.refund → payment:pi_…

CRM

Contact updates, pipeline changes and bulk edits across customer records.

salesforce.contacts.update

Databases

Reads that turn into writes, deletes and migrations against live data.

records.modify → table:orders

Internal APIs

Admin endpoints and service-to-service calls that were never designed for autonomous callers.

accounts.suspend → user:8841

MCP tools

Every MCP server added to an agent is a new set of tools it can call without asking.

github.merge_pull_request

Email

Outbound messages to customers, vendors and anyone else an agent decides to contact.

email.send → destination:external

File systems

Shared drives, buckets and repositories — including the restricted data inside them.

files.export → data_class:restricted

Business workflows

Approvals, provisioning and order flows where one wrong step has real consequences.

orders.cancel → order:SO-20931

Typical agent access today

One long-lived key with broad scopes
No record of which agent did what, or why
No checkpoint before high-impact actions
Revoking access means rotating everything

With Mother AI

A stable identity for every agent
Least-privilege policies evaluated on every action
Human approval where the stakes require it
An evidence trail for every decision

How it works

One checkpoint between the decision and the action.

Your agent — or the tool layer it calls through — asks Mother before executing a protected action. Mother answers in a single deterministic evaluation and records the evidence. Anything other than an explicit allow means do not execute.

01
Identify the agent

The request is authenticated with an organization key and matched to a registered agent identity and environment.
agent_id: "billing-agent-prod"
02
Evaluate the requested action

Capability, operation, resource, destination, data class and context are normalized into one canonical request.
payments.refund · amount 4200
03
Apply policy

Every enabled policy in scope is evaluated. Precedence is fixed and documented — never dependent on rule order.
block > review > allow > default
04
Allow, review or block

Mother returns a machine-readable decision and reason code. Review holds the action for a human approver.
allow · review · block
05
Record evidence

The decision, policy, reason and redacted context are written to an append-oriented audit trail before the response.
decision_id: "dec_…"

Fail closed, by design

Invalid key, disabled organization, unknown agent, malformed policy or an evaluation error all resolve to block with a reason code. Mother never allows an action because something went wrong.

Live interactive demo

Send a request. Watch the policy engine decide.

This runs the production Mother AI policy engine against a fixed demo workspace. Pick a scenario or edit the request — the decision, the reason and the policy that fired come straight from the engine.

Scenarios

Loading demo workspace…

Agent Capability Operation Resource Destination Data class context.amount optional, numeric

Choose a scenario and evaluate it. The decision appears here.

—

— Round trip, measured in your browser

reason_code: —
reason: —
policy: —
evaluated: —
engine: —

Matched policies

Demo unavailable

The demo workspace could not be reached. Please try again shortly.

POST /api/demo/evaluate

{}

// Evaluate a request to see the response

Agent identity

Every agent gets a name, an environment and a leash.

Stop treating "the AI" as one anonymous API key. Register each agent with a stable identity so policies, approvals and evidence all attach to the specific agent that acted.

Stable agent IDs. Human-readable keys like collections-agent-prod that survive model and prompt changes.
Environment binding. A staging agent can't present itself as production.
Registered-agent mode. Requests from agents you haven't registered fail closed.
Disable one agent instantly. Without rotating credentials for every other agent.

Billing Agent

billing-agent-prod

Active

Environment: production
Default mode: block
Bound policies: 3
Gateway key: mai_live_7Qf2…

Policies

ALLOWRefunds up to threshold
REVIEWHigh-value refunds require approval
BLOCKRestricted data egress

Example agent. Keys are shown by prefix only — Mother never stores raw keys.

Policy enforcement

Deterministic rules your security team can read.

Build policies visually from the fields Mother evaluates. Same request, same policies, same decision — every time. No language model decides whether a protected operation is permitted.

High-value refunds require approval

priority 20 · scope: billing-agent-prod · v3

IF capabilityequalspayments

AND operationequalsrefund

AND context.amountgreater_than1000

THEN REQUIRE HUMAN APPROVAL

Preview against sample requests

payments.refund · amount 4200REVIEW
payments.refund · amount 180NO MATCH
payments.refund · no amountREVIEW

fields agentenvironmentcapabilityoperationresourcedestinationdata_classcontext.*

Precedence

1BLOCKAny matching block policy wins.
2REVIEWOtherwise, any matching review policy holds the action.
3ALLOWOtherwise, a matching allow policy permits it.
4DEFAULTNothing matched: the configured default — deny unless you choose otherwise.

Priority decides which policy is reported when several of the same effect match — it never lets an allow override a block.

Operators

equalsnot_equalsinnot_instarts_withgreater_thanless_than

Read-only research

research-agent-prod

Allow knowledge.read and records.read. Block records.modify and anything under finance.

High-value finance

billing-agent-prod

Allow refunds under the threshold. Above it, review — a human approves before execution.

Restricted-data egress

All agents

If data_class = restricted and destination = external, block. No exceptions by prompt.

MCP governance

Every MCP tool call is an action. Treat it like one.

The Model Context Protocol makes it trivial to hand an agent new tools. Mother understands an MCP tool call — server, tool, arguments, calling agent and organization — and normalizes it into the same canonical request as any other action, so one policy set governs both.

MCP tool call

"server": "salesforce",
"tool": "contacts.update",
"arguments": {
  "contact_id": "003Hx…",
  "email_opt_out": true
}

Canonical Mother request

"agent_id": "sales-agent-prod",
"protocol": "mcp",
"capability": "salesforce",
"operation": "contacts.update",
"resource": "contact:003Hx…",
"context": { … }

before-tool-call.ts

// Ask Mother before your MCP client executes a tool call.
const res = await fetch("https://mother.proptechusa.ai/v1/mcp/evaluate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.MOTHER_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    request_id: call.id,
    agent_id: "sales-agent-prod",
    server: "salesforce",
    tool: call.name,
    arguments: call.arguments,
  }),
});

const verdict = await res.json();
// Fail closed: anything but an explicit allow is a no.
if (!res.ok || verdict.decision !== "allow") {
  return refuse(verdict.reason_code, verdict.approval_id);
}
return executeTool(call);

Today

Mother is the policy decision point your MCP client or server calls before executing a tool. Transparent MCP proxying is on the roadmap — we'll say so when it ships, not before.

Human approval

When the stakes are high, a person says yes.

A review decision is real: the action is held until an authorized approver acts. Approvers see exactly who is asking, what it wants to do, why Mother stopped it and which policy fired.

Short-lived by default. Pending requests expire. Expired approvals can't be executed.
Role-based approvers. Only members with approval rights can approve or deny.
Evidence, not edits. Approving creates new audit events. The original decision is never rewritten.

Approval required 14:32

billing-agent-prod

production · requested 12:04:31 UTC

Wants to

payments.refund

$4,200.00USD

payment:pi_3Qx…9Lk

Why Mother stopped it: Refund amount exceeds the 1,000 approval threshold.
Policy: High-value refunds require approval · v3
Reason code: HUMAN_APPROVAL_REQUIRED

Example approval card

Audit trail

Know exactly what every agent tried to do.

Every evaluation becomes evidence: agent, capability, operation, resource, policy, decision, reason and timestamp — in a tamper-resistant, append-oriented audit trail. There is no API for rewriting history.

Example events

12:07:52

BLOCKsupport-agentfiles.exportbucket:exports/customers.csv

RESTRICTED_DATA_EGRESS · Restricted data egress · destination external
12:06:10

APPROVEDj.riveraapprovedapr_8XkQ…

Approval event recorded · original decision dec_4Jm2… unchanged
12:04:31

REVIEWbilling-agent-prodpayments.refundpayment:pi_3Qx…

HUMAN_APPROVAL_REQUIRED · High-value refunds require approval · amount 4200
12:02:18

BLOCKresearch-agent-prodrecords.modifyrecord:acct_2291

OPERATION_NOT_ALLOWED · Research agent is read-only
12:01:44

ALLOWresearch-agent-prodknowledge.readdoc:pricing-faq

POLICY_ALLOW · Research agent read access
11:58:03

POLICYa.chenupdatedHigh-value refunds require approval → v3

Control-plane change recorded with the new policy version

Credential-like fields in context are redacted before storage Approvals and policy changes are separate events Filter by agent, decision, capability, environment and date

Mother AI Protected

Make your AI controls visible.

Your customers are asking what your AI agents can do with their data. Show them. Organizations with live Mother AI controls can display a dynamic Mother AI Protected badge that links to a public verification page — served live from Mother, so it can't outlast the controls behind it.

Example badge

MOTHER AI PROTECTEDAI Controls Active

Badge status is live

ACTIVEAll controls configured and enabled.
SETUPControls not yet fully configured.
SUSPENDEDControls were disabled after activation.
REVOKEDBadge withdrawn. Never renders green.

embed.html

<a href="https://mother.proptechusa.ai/verify/TOKEN">
  <img src="https://mother.proptechusa.ai/badge/TOKEN.svg"
       alt="Mother AI Protected — AI Controls Active">
</a>

Mother AI Protected

Organization: Acme, Inc.
Status: ACTIVE

Agent identity configured
Policy enforcement enabled
Human approval capability enabled
Audit logging enabled

Last verified · live at page load

Example verification page for a fictional organization.

Earned by configuration, not by signing up

The badge only turns active when every requirement is met — and it changes state automatically when they aren't.

Organization active
Gateway enabled
Audit logging enabled
At least one active agent
At least one enabled policy
An active production API key

Mother AI Protected indicates that this organization has configured and enabled Mother AI agent access controls. It is not a certification of the organization's entire cybersecurity program or a guarantee against security incidents.

Founding Access

Put your agents behind Mother.

Mother AI is in early access. The gateway and policy engine are live; some enterprise integrations are still rolling out. Founding teams work directly with the people building it.

Real enforcement from day one. Agent registry, policies, approvals and audit on the production gateway.
Shape what ships next. Integration and MCP priorities are set with founding teams.
Straight answers. We'll tell you what Mother does today and what it doesn't.

Name Company Work email What do your agents do, and what do you need to control? Approximate number of agents Do you use MCP?

Your AI has permissions. Mother enforces them.

Payments

CRM

Databases

Internal APIs

MCP tools

Email

File systems

Business workflows

Identify the agent

Evaluate the requested action

Apply policy

Allow, review or block

Record evidence

Fail closed, by design

Every agent gets a name, an environment and a leash.

research-agent-prod

billing-agent-prod

All agents

When the stakes are high, a person says yes.

Earned by configuration, not by signing up

Put your agents behind Mother.

Request received.