How do we stop everything if an agent misbehaves?

The organization-wide kill switch halts every agent immediately, including external ones acting over the protocol. In-flight runs end at their current turn, and the record of what had already happened remains intact and attributed.

Can we tell what an agent did versus what a person did?

Yes. Agent actions are attributed to the agent in the room timeline along with the mandate in force at the time, and human approvals and signatures are bound to identities. The two are never indistinguishable.

What authority does an agent connecting over MCP have?

Exactly what its scoped credential grants, and no more. It is bound by the same clause gates, mandates and caps as the built-in assistant, it cannot sign, and its credential is revocable at any time.

Do you hold a security certification?

Not one we publish, and we will not imply otherwise. We will describe our current controls and documentation plainly on request. Everything this page claims is a mechanism you can inspect in the product rather than a badge.

Mechanisms you can check, not badges

Agents acting on agreements raise a specific question: what exactly can this thing do, and how would we know what it did? This page answers that with mechanisms. Where we hold no certification, we say so rather than implying one.

What an agent can never do

These are not settings an administrator could accidentally relax. They are properties of the platform, which is the only version of this list worth publishing.

Pass a mandatory-review clause — A clause configured for mandatory review stops every run at every autonomy level. The gate belongs to the clause, so no agent configuration can override it.
Sign on a human's behalf — An agent can prepare, request and chase signature. It cannot be a signatory, and signer identity is captured per human signature.
Alter a locked version — Once a version is locked for signature it is immutable. A change produces a new version and invalidates signatures collected against the old one.
Act without attribution — Every agent action appears in the room timeline attributed to the agent, with the mandate in force at the time. There is no unlogged path.
Exceed its mandate — A position outside the playbook ends the turn and escalates. The agent does not improvise an authority it was not granted.
Ignore its caps — Turn and spend ceilings pause the run with a summary. An unproductive negotiation stops rather than continuing to consume budget.

Credentials that are scoped and revocable

Paqt exposes its agreement surface over the Model Context Protocol, which means agents you run can act in it. That reach is granted deliberately and withdrawn instantly.

Scoped credentials — An external agent receives access to the rooms and operations you grant it, not to the workspace. Scope is explicit rather than inherited from a user.
Every call recorded — Tool calls are logged with their inputs and effects, so an external agent's activity is reviewable in the same timeline as everything else.
The same limits apply — An agent arriving over the protocol is bound by the same clause gates, mandates and caps as the assistant. Being external grants no additional authority.
Immediate revocation — Credentials are revocable, and the organization-wide kill switch halts every agent at once — including external ones — with in-flight runs ending at their current turn.

Access, data and the record

The mechanisms below exist today. Ask us for our current security documentation and we will describe our posture accurately rather than aspirationally.

Access: Per-party visibility inside a shared room
Access: Internal discussion separated from counterparty-visible turns
Access: Role-based access within an organization
Access: Scoped, revocable credentials for external agents
Data: Encrypted in transit and at rest
Data: Your clause library and templates remain yours
Data: Complete record exportable per agreement
Data: Only marketplace listings you publish leave your workspace
Record: Timestamped, tamper-evident agreement history
Record: Approvals bound to a version and an identity
Record: Agent actions attributed with their mandate
Record: Overrides recorded as explicit acts

What we do not claim

We publish no compliance certification, and nothing on this site should be read as asserting one. That is a deliberate position: a certification claim is either complete and auditable or it is marketing, and we would rather lose an evaluation than win it on an implication. Ask us about our current security documentation and we will tell you where we actually are.

No certification or audit-report claim appears anywhere on this site, enforced by an automated test in the build
No third-party integrations are claimed; the Model Context Protocol surface is the supported way to connect your own systems
No customer names, logos or performance statistics appear on this site, because we are not prepared to invent them
If a completed certification is a hard procurement requirement today, we would rather you know that at the start of an evaluation than at the end

What security teams ask us

How do we stop everything if an agent misbehaves? The organization-wide kill switch halts every agent immediately, including external ones acting over the protocol. In-flight runs end at their current turn, and the record of what had already happened remains intact and attributed.
Can we tell what an agent did versus what a person did? Yes. Agent actions are attributed to the agent in the room timeline along with the mandate in force at the time, and human approvals and signatures are bound to identities. The two are never indistinguishable.
What authority does an agent connecting over MCP have? Exactly what its scoped credential grants, and no more. It is bound by the same clause gates, mandates and caps as the built-in assistant, it cannot sign, and its credential is revocable at any time.
Do you hold a security certification? Not one we publish, and we will not imply otherwise. We will describe our current controls and documentation plainly on request. Everything this page claims is a mechanism you can inspect in the product rather than a badge.