AI agents can act. Herkus makes every real-world action happen as approved, and only once.
Herkus controls what AI is allowed to change, and protects what external AI is allowed to see.
Control what AI can do. Protect what AI can see.
Execution control for real-world actions. AI Data Masking is available today, with a proof of concept in your own VPC.
Execution Guardian and Execution Gateway
Only what was approved, never the same real-world effect twice, and stop when the outcome is unclear, across retries, replanning and reassignment.
AI Data Masking
Sensitive business data is masked before it reaches external AI models, and restored only when the workflow needs it, after the response is checked.
AI agents now create real consequences.
No attacker needed. Retries, timeouts, lost connections and changed plans are enough to turn a correct action into an incident.
The refund timed out. Did it fail, or did only the answer get lost?
The agent retried. Did the first order change already go through?
The task was replanned. Will the old command still run?
Three questions, answered together, before anything happens.
Only when all three allow it may the action go ahead, and only one request may cross into the real world.
Within what was approved?
The request that actually goes out must match what was approved for this task. Approve a €100 refund for order 48213, and €1,000, or another order, is refused.
Is the execution still valid?
Retries, replanning and reassignment create new executions. A replaced or cancelled one cannot act, even if its credentials still work.
Has it already happened, or is it unknown?
If the same action already took effect, it must not happen again. If nobody knows yet, it waits until the facts are established.
A timeout should not become a second refund.
An AI agent issues a €100 refund. The request times out. Nobody knows whether the money went out.
Refund €100 sent to the provider.
Timeout. No answer comes back.
The agent assumes it failed and tries again.
€100 sent again.
Refund €100 sent to the provider.
Timeout. No answer comes back.
Same refund again? HOLD: the first one is unresolved.
Provider checked: the first refund went through.
A new refund the customer asks for later is a different action and goes through normally.
The agent tries to call the payment provider directly.
It holds no key. It never did.
The only path is the Gateway, which asks Guardian first.
Guardian decides: allow, hold or block.
It depends on where the action takes effect.
Execution Guardian decides. Execution Gateway makes the decision unavoidable in systems you do not control.
Execution Guardian
When the action takes effect in a system you control, Guardian is built into your execution step.
e.g. robot task controllers · your own ledger · your own ERP write service
Execution Gateway
When the action takes effect in someone else's system, the Gateway holds the entry point and the credentials, so every protected action passes Guardian.
e.g. payment providers · third-party ERP · logistics platforms
Permission is not execution authority.
Identity and policy remain important inputs. They cannot tell you whether this specific action may still happen now, or whether it already happened.
| Question | IAM / identity | Policy engine / AI gateway | Herkus |
|---|---|---|---|
| Who is calling? | Yes | Often | Uses it as input |
| Is this kind of action generally allowed? | Partly | Yes | Uses the result as input |
| Is this request within what was approved for this task? | No | Sometimes | Checked before it goes out |
| Is this execution still the valid one? | No | Rarely | Checked |
| Did the same action already happen, or is it unknown? | No | Rarely | Checked; unknown means wait |
Start where one wrong action is expensive.
Payments and refunds
Timeouts and late confirmations without duplicate payouts.
E-commerce operations
AI customer service and operations agents that refund, reship, reprice or change orders.
Enterprise systems
ERP and CRM writes that stay within the approved task, and happen once.
Robotics
Task-level control: no repeated tasks, no stale commands. Complements functional safety; does not replace it.
Start with one real action.
Pick one workflow where an AI agent can cause a real business or physical effect, or one external AI call with sensitive data. We scope it together.