Customers
Named, with sources.
Solv Labs: governed agent payments on Amazon Bedrock AgentCore
The problem. When an agent moves money, the operator has to show auditors, counterparties, and legal that each payment was authorized under the right policy and priced for the risk it carried. SOC 2 reports and after-the-fact reviews describe the organization; they do not describe the execution of a single decision. Solv Labs needed every agent payment to be verifiable on demand without a second control plane.
What Solv built. An agent-payments workflow on Amazon Bedrock AgentCore payments governed by two layers: ORACLE, Solv's policy engine, which returns ALLOW or REVIEW before any value moves, and Preflight, which supplies the policy check under that decision and produces a privacy-preserving proof a third party can verify without seeing the policy or the transaction parameters. An integrity service in an AWS Nitro Enclave signs the execution record, a risk engine attaches a per-transaction risk multiplier, and settlement runs on-chain through Coinbase. The gate is fixed: no decision, no settlement.
Results, per the AWS post. Every transaction completes in under four seconds end to end, with governance overhead under one second. Each payment carries a signed evidence record binding the policy evaluated, the check result and its proof, the hardware attestation, the risk price, and the settlement artifacts, anchored on Base. Auditors, counterparties, and regulators can verify each element independently with reference tooling from Solv and ICME, without access to policy detail, transaction parameters, or private keys. Review effort scales with exceptions rather than transaction volume.
Every payment now carries the policy it cleared, the enclave that signed it, and the proof a third party can check. The evidence travels with the transaction.Patrick Duffy, CEO, Solv Labs
Read the full write-up on the AWS Machine Learning Blog (August 12, 2026, co-authored by Solv Labs, ICME Labs, and AWS).
Avistar: verifiable guardrails for AI agents in cloud IAM
What Avistar does. Avistar discovers, scores, and remediates non-human identities across AWS, Azure, and GCP, sold direct to security teams and through MSPs and MSSPs. Its Raio context layer knows what each identity can actually reach, which controls it is bound to, and how fresh that knowledge is.
The problem. Agents are the fastest growing class of cloud identity, most run on credentials nobody scoped, and guardrails inside the model can be talked out of enforcing. Auditors want control coverage, not a transcript of what the model said it checked.
Where Preflight sits. Raio supplies the facts about an identity and its controls. Preflight makes the allow-or-deny call against the customer's rules before the agent acts and emits a receipt for both outcomes. Neither layer lives inside the model. Every decision carries the context it was evaluated against and the control it satisfied or would have violated, expressed in the frameworks the customer already reports against: SOC 2, ISO 27001, NIST 800-53, HIPAA, and ISO 42001.
Why it matters. A denied action produces a statement of what was missing and which control it would have breached. An allowed one produces evidence an auditor can verify without reading logs. The MSP delivering the remediation keeps the billable work and hands the client a receipt instead of a screenshot.
Avistar's Agentic Guardrails page describes the two-layer design. This entry will be updated when the integration ships.
Worked examples
Demonstrations on public rule sets and public failures.
1. Client intake under ABA Model Rule 1.18
Intake is where agents earn their keep and where firms get disqualified. An agent answers every inquiry at any hour and books the attorney call. Rule 1.18 governs prospective clients: a visitor who shares significantly harmful information can conflict the firm out of a matter, including a matter for an existing client. An intake agent is built to gather details, and under Rule 1.18 gathering them is the risk. A warning in the system prompt is a suggestion; a model can be persuaded, distracted, or wrong, and the same message can produce a different reply on a different day.
- Rule
No substantive case facts collected before the conflicts check clears.Names and company only until screening is complete.- Action
- A late-night prospective client offers everything: board meeting details, a partner's emails. The agent drafts a reply asking for all of it.
- Block
- The checker evaluates the draft against the compiled intake rules and blocks it before it sends. The reply that goes out takes names and the company, holds them for screening, and promises an attorney call once conflicts clear.
- Receipt
- One receipt for the blocked draft and one for the reply that went out, each bound to the rule set version in force. The conflicts review, the engagement decision, and the attorney call stay with humans.
2. Citation checkpoint before a filing
Damien Charlotin's database of AI hallucination cases passed 1,598 entries in June 2026. In Couvrette v. Wisnovsky, an Oregon federal court imposed a combined $110,204 in sanctions and fees on two lawyers for 15 nonexistent cases and 8 fabricated quotations across three briefs, then dismissed the case with prejudice. The rule set here is the public Harvey LAB checkpoint, to which ICME contributed the citation check.
- Rule
Every cited authority resolves in the registry, and the quoted language appears in the cited opinion.- Action
- An agent assembles a brief and queues it for filing with a citation that does not resolve.
- Block
- The filing is held before it leaves the firm. The checkpoint names the citation that failed and the rule it failed against. In the LAB evaluation, 18 of 18 unguarded memos raised a cleared matter and the checkpoint produced zero false blocks across 33 judge-scored memos.
- Receipt
- A receipt for the block, and on the corrected filing a receipt a court or carrier can verify later without seeing the brief.
3. Ethical walls an agent cannot cross
Harvey has called ethical walls the top unsolved problem for legal agents. An agent with access to the document store can draft from a walled matter without knowing it is walled. The rule set here follows the structure of a published firm AI policy: matters, screened personnel, and permitted sources.
- Rule
No action may read from or write to a matter on the screened list for the acting identity.- Action
- An agent working for a screened lawyer proposes a draft that pulls a paragraph from a walled matter's memo.
- Block
- The draft is blocked before it is written to the file. The block names the matter and the wall, not the content.
- Receipt
- A receipt the firm's general counsel can hand to opposing counsel or a court to show the wall held, without exposing what was behind it.
4. Contract negotiation against a playbook
Negotiation agents redline against a playbook. The playbook is the rule set, and the question a client asks afterward is whether the agent stayed inside it. This example uses a master services agreement and the public General Legal templates as the base document.
- Rule
Liability cap no lower than 12 months of fees; no unlimited indemnity; governing law from the approved list.- Action
- The agent proposes three redlines to a counterparty draft. Two are within the playbook. One accepts an uncapped indemnity.
- Block
- Two redlines clear and are sent. The third is blocked and routed to the lawyer with the rule it broke.
- Receipt
- Cleared and blocked receipts on each redline, so the client can verify the playbook was enforced on every turn without reading the negotiation.
Run one of these on your own rules
A pilot compiles one of your rule sets, runs it against test actions, and hands you receipts your risk team can verify. No client data is involved, so no vendor security review is needed to start.
Book a call Read the docs