The human-in-the-loop control plane for AI agent actions
An agent that reviews every supplier invoice as it arrives — duplicates, IBAN changes, split amounts — and only escalates what does not add up. Human approves in Slack. Every decision sealed in a tamper-evident audit trail your auditor can verify offline. EU-hosted, deterministic, no LLM in the critical path.
Get early access — we'll send the quick-start and tell you when we open seats.
Work email only. Double opt-in, one-click unsubscribe, no spam.
01 — The problem
iban swapped
Your agent pays the recurring supplier it always pays — to the bank account a fraudster swapped in last night. The instruction was legitimate. The destination was not. Nothing checked the IBAN against the one on file before the transfer fired.
limit evaded
Three invoices of €1,900 from the same supplier in 24 hours. Each one clears the €5,000 approval limit on its own. Together they don’t. No single approver ever saw the sum — because nothing was watching the window.
no trail
An agent misreads a PDF and pushes the wrong payment. Then your auditor asks you to prove every invoice action was policy-checked or human-approved, with provenance. You have Slack history and an ERP export. You don’t have a tamper-evident trail.
02 — The solution
pip install pliuz or npm install @pliuz/sdk, then wrap any risky tool call with @gated in Python or gated() in TypeScript. The SDK pauses the call and POSTs it to Pliuz before the tool fires. No admin UI to build, no lock-in: first-class adapters for LangChain, the Vercel AI SDK, the OpenAI Agents SDK, and the Claude Agent SDK ship in the box, and the wrapper is framework-agnostic — LangGraph, CrewAI, or a plain HTTP runner like n8n.
@gated(policy="invoice-exception")Pliuz evaluates your JSONLogic policy server-side: deterministic, no eval, no exec, no LLM in the critical path. The safe majority auto-approves; everything else routes to your approver group, who approve, edit, or reject in Slack or the web inbox. The agent long-polls one held-open request instead of hammering a poll loop, and an edit runs the edited arguments — never the originals.
policy decides → human resolvesEvery decision appends to an events table that blocks UPDATE/DELETE/TRUNCATE and chains each row with SHA-256. The audit makes why it went through unambiguous — a policy, a tool flag, a standing grant, or a named human. You don’t take that on trust: verify it yourself with one SQL call.
SELECT * FROM pliuz_verify_chain()03 — What you get
Every audit row carries an auto_approve_source field — policy, tool_flag, standing_grant, or a named human. When a CISO asks "why did this action go through without review?" you have an exact answer in a structured field, not a postmortem.
"auto_approve_source": "policy"SHA-256 AUDIT CHAIN
0x9f…
gate
0x3a…
policy
0xc7…
human
0x1e…
exec
pliuz_verify_chain() -> OK ✓
Wrap any tool call in Python with @gated or in TypeScript with gated(). First-class adapters for LangChain, the Vercel AI SDK, the OpenAI Agents SDK, and the Claude Agent SDK; the wrapper is framework-agnostic, so it also drops into LangGraph, CrewAI, or custom runners — and any HTTP-capable runner (n8n, etc.) calls the REST API directly.
@gated(...) / gated(...)pip install pliuz · npm install @pliuz/sdk
Write JSONLogic once: amounts under €100 auto-approve, a session flagged production auto-rejects, everything else routes to your approver group. 14 whitelisted operators, validated before they persist; reject always wins. Server-side, deterministic — no eval, no exec, no LLM in the critical path.
{"<": [{"var": "args.amount"}, 100]}policies/finance.json
Every approval, edit, rejection, and execution lands in an append-only events table chained by SHA-256. Run pliuz_verify_chain() — it returns OK or names the broken event.
SELECT * FROM pliuz_verify_chain()public verification RPC
Supabase Frankfurt (eu-central-1) by default. RLS on every public base table (21/21). SDK-side field-level redaction so sensitive values never leave your process. DPA template available on request, with signature pending counsel review and entity formation. No LLM in the critical path.
eu-central-1 · RLS on every table
Approve once for a window, not forever — "this session / 1 hour / until I revoke," bound to the exact approved arguments, revocable, and fully audited. A policy auto-reject is never overridden.
scope + TTL · args-boundauto_approve_source: standing_grant
Every logic change freezes an immutable version snapshot, so "which rule and version decided this?" is answerable. Run a new rule in shadow — evaluated and logged, never deciding in production — until you trust it.
policy_versions · shadow evaluations
Delegate your authority over a group for a window, enforced across REST, web inbox, and Slack. Off-shift snooze stops the 3am DMs while the channel card still posts — vacation cover without a shift model.
delegation · off_shift_until
p50 / p95 / p99 decision latency and timeout-rate per policy and approver group. See whether your approvers — not your agents — are the bottleneck, per rule.
p50 · p95 · p99 · timeout-ratepliuz_decision_latency_slos()
Watch it work
Ninety seconds: an agent hits a gated action, a human approves it in Slack, and the decision lands in a verifiable, tamper-evident audit trail.
Product demo
Oversight, built in
This is the real product — the same gate, decision and policy from the quickstart docs ↗.
04 — Security & trust
EU-hosted by default
Supabase Frankfurt (eu-central-1). US region planned, not default.
Append-only events table
Cryptographic source of truth. Convenience tables are projections.
SHA-256 hash chain
Verifiable by you via SELECT * FROM pliuz_verify_chain()
RLS on every table (19/19)
Row-level security on all 19 public base tables; deny-by-default for anon/authenticated, backend service_role paths stay tenant-scoped.
No LLMs in the critical path
Policy evaluation is deterministic JSONLogic. Your payload never touches an external model.
SDK-side redaction
@gated(redact=[...]) and gated({ redact: [...] }) send masked fields to Pliuz. We never see the original.
Per-event auto_approve_source
Every audit row says exactly what allowed the action — policy, tool_flag, standing_grant, or a named human.
Right-to-erasure without breaking the chain
Tier-based retention nulls raw PII and on-demand tenant erasure wipes personal data — the hash chain stays verifiable because it stores hashes of the arguments, not the raw arguments.
Management API on least-privilege machine tokens
Scoped plm_live_ tokens provision agents, policies, and tools — they never run approvals nor mint agent keys, and every write is attributed via acted_via in the audit trail.
Strict CSP, nonce per request
Content-Security-Policy with a per-request nonce on every response — no inline-script execution from injected markup.
Liveness endpoint at /api/v1/health
Unauthenticated health check for your uptime monitoring — no tenant data, no side effects.
Sub-processors listed publicly
Supabase (EU), Vercel (EU), Plausible (EU), Resend (EU), Cloudflare, Slack — at /legal/subprocessors
DPA at /legal/dpa
Template available on request; signature pending counsel review and entity formation.
Encryption at rest AES-256-GCM
Bound per tenant (AAD = tenant_id), so an encrypted blob cannot be reused across tenants. TLS 1.3 in transit, no exceptions.
No training on customer payloads
No payload inspection for "product improvement". No retention beyond your configured policy.
0+
PRPs shipped
core backend, Slack OAuth, SDKs, auth, metrics, security, legal
0
audit event types
CHECK-constrained at DB level
0/19
tables with RLS
every public base table — no exceptions
0
materialized views
refreshed every 5 minutes by pg_cron
0
JSONLogic operators
whitelisted — no eval, no exec
Apache 2.0
Open-source SDKs
Python + TypeScript on GitHub
Why design partners
We're selecting 3–5 teams running 2+ agents in production. You get direct onboarding with me in the first two weeks, 40% off year one, preferred support, and real influence on the roadmap. Easy exit: 30 days' notice, your data exportable as signed JSONL.
05 — FAQ
Today the SDK fails closed, always: if Pliuz is unreachable, the gated call raises a typed error (PliuzNetworkError / PliuzApprovalTimeoutError) and your tool never executes — for high-risk actions, halting is safer than acting unsupervised. A per-call fail_open mode for low-risk tools (execute on outage, reconcile to the audit chain on reconnect) is on the SDK roadmap but is NOT shipped yet — do not architect around it today. SLA targets: 99.9% on Pro/Team, 99.95% on Enterprise — committed in the MSA at signing. Currently in pre-launch waitlist phase, so a live availability metric is not yet meaningful; we will publish a public status page from launch.
Not in the MVP. BYOK field-level encryption via AWS KMS / HashiCorp Vault is on the roadmap, prioritized by first enterprise prospect ask. If you need it to sign, talk to us — we will ship it for you and you will be the design partner.
Not today. A self-hosted edition is on the roadmap for regulated industries; right now everything runs on EU-hosted managed infrastructure (Supabase Frankfurt / eu-central-1), which clears most data-residency requirements. If on-prem is a hard gate for you, raise it on the founder call — that is how it gets prioritized.
You can — and the first cut looks cheap. What DIY teams under-scope is the part that ships last and weakest: a durable approver inbox, declarative policies, and a tamper-evident audit chain you can hand an auditor. That is the layer you would build once, get audited on, then maintain forever as Slack, your frameworks, and the regulations all move. Pliuz ships all three on day one, EU-hosted.
We are in waitlist phase, so public pricing is not live yet — billing goes live at GA, and the dev track is free and ungated today (pip install pliuz, Apache-2.0, no email). When we publish tiers we will charge per agent slot, not per approval — we do not want you rationing approvals. Join the waitlist to lock in early-access terms.
Not yet, and we will not pretend otherwise. SOC2 Type I is planned for Q4 2026. A HIPAA BAA is available on Enterprise once we have the design partner to do it with. EU AI Act Article 12 (audit logs) and Article 14 (human oversight) are mapped to product features and internally documented (NDA-shareable); independent counsel review is pending. We give you the mechanism — a verifiable audit chain, human oversight, per-event provenance — and your auditor makes the certification call.
You probably should not trust any startup with critical infrastructure without an exit path. Our exits: (a) SDKs are open-source so you can fork, (b) your audit data is yours — self-serve Ed25519-signed JSONL export, verifiable offline with our open-source verifier and a public key you pin through an independent channel, (c) the schema is documented so you can re-implement on top of Postgres if we disappear. We are betting you will stay because the product is good, not because you are locked in.
Pausing an agent is a one-line primitive (for example, LangGraph interrupt()). The hard, lasting work is the layer around it: durable resume, Slack and web routing, timeouts and a fail posture, idempotency, a declarative policy engine, and a tamper-evident audit trail — built once, audited on, and maintained forever. Build it if approval logic is your product and you have the senior-engineer time to spare; otherwise a control plane like Pliuz ships and maintains all of it behind one decorator, across any framework.
Three properties together: append-only storage that rejects updates and deletes at the database, SHA-256 hash-chaining so any altered record breaks every hash after it, and independent verifiability so a third party can re-compute the chain offline. Pliuz does all three — every decision is hash-chained, and you verify it yourself with pliuz_verify_chain() or an Ed25519-signed offline export. The chain hashes the arguments rather than storing raw PII, so a GDPR erasure never breaks it.
Early access · pre-revenue · building in the open
Drop your work email and we’ll send the quick-start and tell you when we open seats — that’s the whole ask. Running 2+ agents in production? Apply to the design-partner track below for a 1:1 with the founder (a calendar, not an SDR) and early access to what’s already shipped: signed audit export, standing approvals, policy shadow mode, delegation, and the decision-latency SLO dashboard. The dev track stays free and ungated — pip install pliuz, no email. Double opt-in, one-click unsubscribe, no fake “spots left.”
Running 2+ agents in production? Apply to the design partner program →·Calculate your ROI →
pip install pliuz · Apache-2.0 · Python + TypeScript SDKs on GitHub