Let your agents act.
Take it back when they shouldn't have.

That dialog assumes a human is watching one agent in a terminal, in real time. Ripcord assumes nobody is watching fifty agents overnight. Built-in prompts also pattern-match the tool, not the stakes: they can't say "new beneficiary, 4.7× the normal amount." And approval is where their safety story ends: no risk scoring, no snapshot, no rollback, no learning, no cross-vendor audit trail. The button is the same; everything around the button is the product.

Each lab's controls govern only its own agents, and best-model-for-the-task means your fleet runs several. Three half-controls with three audit formats isn't governance three times; it's governance zero times. Ripcord sits at the tool-call layer beneath every vendor: one policy, one inbox, one record. And when something goes wrong, an independent audit trail counts for more than the lab's own record of its own agent: nobody believes the referee who plays for one of the teams.

A card limit is a wall, and walls don't read invoices. Give your procurement agent a $50k card limit: reasonable, real invoices run that size, and the $48,200 payment to a fraudulent vendor sails through inside the limit. Crank the limit down and legitimate invoices start failing back to human tickets: the leash returns, enforced by the card. Cards also govern the wrong rail (B2B money moves by wire and ACH) and answer one line of a six-line problem: they're silent on deletions, mass emails, and rollback. We like agent cards: they're the containment primitive for one corridor, and Ripcord happily uses them as defense-in-depth. A card caps how big the mistake can be. Ripcord works on whether it happens at all, and what happens after.

Especially for you, because your first agent can be born on the leash. The launch wizard builds one in a few steps: pick the brain (seeded from public arena leaderboards, refreshed weekly once connected, and over time re-ranked by your own ledger: consequences, not votes), give it a job, and set its rules. Those rules are not prompt suggestions: "publish only during working hours" and "product announcements Wednesday at 11am ET" become scorecard signals the gateway enforces. Break one, and the action is held before it runs. Start with the safest role there is: the night-shift research agent that browses competitors, fundraising and new techniques while you sleep, reads running free in a logged read-only lane, and delivers a morning brief that waits in escrow for your 7:30 slot. An agent that starts life governed never gets to be the standoff.

Ask why your CFO still can't wire $10M alone. A senior CFO almost never fat-fingers a transfer, yet segregation of duties, two-person rules, and audit trails exist anyway, because controls are about accountability and adversaries, not competence. A perfect agent still perfectly executes a wrong instruction, a forged invoice, or an attacker's injected prompt, and even perfect actions get disputed. Firewalls and flight recorders grew as systems got safer, because safety enabled volume. What fades is catching incompetence; what grows is authorization, containment, and evidence.

It will happen: a risk engine that catches everything is an oracle, and security's founding axiom is assume breach. What changes with Ripcord is everything around the miss: the action went through the gateway, so forensics is one query instead of weeks of archaeology; the blast radius: everything the compromised agent touched: is instantly visible, and whatever's still inside a rollback or compensation window comes back; the agent freezes with one policy flip; and the attack pattern is folded into the engine: it scores 80 tomorrow — live today per customer, and for every customer as the network grows. The money that's still gone is what the insurance layer exists to absorb: a loss despite reasonable controls is the definition of an insurable event, and the audit trail is the claims file that settles it in days, not months. Prevent, contain, recover, absorb. No loss goes unpriced.

That block is usually the rational one, and it is the one Ripcord is built to convert. Four mechanisms, one chokepoint: tokenization at the gateway, so PII is swapped for vault tokens before the model reads it and the provider only ever sees pseudonyms; egress in the scorecard, so bulk personal data leaving the boundary fails closed like a suspicious wire; the lineage ledger, a hash-chained record of every field that crossed the boundary, which turns subject-access requests and breach scoping into a query; and residency routing, so EU data stays on EU brains and sensitive corridors go self-hosted. It is the credential vault's trick applied to data: your agent can't leak what it never saw.

The scary version isn't the hacked agent: it's the one that aced the benchmarks and then starts doing things you never asked. Ripcord watches conduct, not vibes: every action is checked against the agent's mandate and its own history. An ops agent making its first-ever payment call gets held and classified DRIFT. The same action re-submitted after a human said no is ESCALATION, and the agent freezes on the spot: everything further from it fails closed. Runaway loops trip VELOCITY. Every incident lands in the monthly report as a conduct grade per agent, A to D, with the fix spelled out. You find out from a graded ledger, not from the bank statement.

Today: a log-odds scorecard (the same math as FICO and insurance rating tables) with an expected-loss gate: Gate = P(flag) × $exposure × (1 − recoverability). Named signals with weights (new beneficiary +45, 4.7× the vendor's normal +35), summed, calibrated to a probability, and itemized: every point is a reason a human can argue with, never a black-box probability. After your first shadow week, the baselines are learned from your own history, so abnormal means abnormal for you, and velocity windows score aggregates across actions (five payments of $9,640 get caught as one $48k). At network scale, every human verdict becomes a training label, and one customer's caught pattern raises everyone's score tomorrow. One more thing no other risk engine does: severity is discounted by our own ability to undo. A snapshot-protected deletion can tolerate more uncertainty than an irreversible wire.

Only badly-designed approval systems drown people. Here, medium risk fails open: a hold you can stop, not a queue you must clear, and only the genuinely scary tier waits for a decision. Repeated approvals become standing rules so the same question never gets asked twice, while dangerous patterns are unlearnable by design. The system's job is making every ask rarer and richer, until the ones that remain deserve real attention.

The reason goes back to the agent as information, and the agent re-plans. "No W-9 on file" doesn't kill the payment: it sends the agent to get the W-9 and resubmit at lower risk. Rejection is feedback, not death: the task survives, the risk doesn't, and the gateway becomes a conversation between agent judgment and human authority instead of a wall. And when a task shouldn't be agent-done at all, Take over hands it to you prefilled: the invoice open in your billing queue, the draft in your outbox. Take over the same pattern twice and Ripcord proposes a standing route-to-human rule: risky patterns can't earn auto-approval, but they can earn a permanent human lane.

Conceded, and the whole engine is built on the concession: severity is discounted by recoverability, so the gate prices exactly what we can and can't take back. But most business irreversibility is process design, not physics. An email is only unrecallable because it left in one breath; sent in batches behind a hold, it stops at #50. A deletion is only permanent without a snapshot; Ripcord takes one before every destructive call. The rule: never execute an action in its irreversible form while a reversible form exists. Every industry that engineered undo into a "final" domain did the same thing: chargebacks, database transactions, git, Gmail's unsend. Throughput exploded, and nobody calls it marketing. And where physics truly wins (an executed wire, a served notice), the residual is priced: a loss despite reasonable controls is the definition of an insurable event. What can't be reversed can be insured.