Blocked
Risk and compliance said no. The project is dead.
Verify · Assess · Enforce · Prove
Let your AI do the real work, and keep the one action that would end a career from ever getting through.
You set the rules. Lokorium enforces what your AI is allowed to do, on every action, at the point it would happen, and hands you the proof. You do not have to choose between moving and being safe.
Where this bites
01 / 10Your AI is ready. Saying yes is the hard part.
Your agents can move money, change records, act on customers, touch the systems that run the business. The capability is here.
What is missing is a way to prove what they are allowed to do, stop the things they are not, and show a regulator exactly what happened. Without that, the safe answer is no. So the project that would pay for itself sits switched off.
Right now your AI project is in one of three places, and none of them is good
Too scared
No one will put their name to a yes. So it stalls.
Risking it
Live on real data, exposed. One wrong action is a breach, a fine, a headline.
The gap you are standing atIllustrative
The value is on the far side. The gap is one wrong action wide.
One legitimate payment. Forty times.
A finance agent at a lender pays approved supplier invoices automatically. It pays a real invoice, correct supplier, correct amount, well inside every limit. Then a retry fires, and it pays the same invoice again. And again. Every one of them looks valid, because every one of them is.
The controls that were in placeIllustrative
- AuthenticationThe agent is who it says it is.Passed
- Token scopeIt may call the payments API. Paying is its job.Passed
- Runtime guardrailsSame process as the agent, so the same blind spot.Passed
- The checker agentReads one payment, sees a valid invoice, agrees.Passed
- Overnight reviewRuns at midnight. Every copy has already cleared.Too late
Every control did its job. Not one asked whether this payment, the fortieth copy of an invoice already settled, was allowed, right now, before it went out.
Forty valid payments. Found out at midnight.
If your AI could do this to your business, this is the problem we close. Tell us where you are exposed.
What you get
02 / 10One place your rules are enforced, on every action, with proof.
Lokorium does not build AI and does not replace what you already run. It sits at the point where an action would happen and checks it against your rules before it executes.
Allowed actions go through. The wrong one is refused, at the moment it matters, and you get a signed record either way. You keep moving. The career ending action does not get out.
Identity and tokens control what the AI can reach. Lokorium controls what it does with it.
If you know the action you cannot let through, tell us what it is.
Verify · Element 01
03 / 10The command is the command.
The instruction is captured and reduced to one exact description of what it will do. What executes must match it. Anything altered on the way, or arriving by another route, fails here.
The artifact is the execution permit. One signed, bounded, expiring permit describes one consequence, in eight parts. Change the target, amount, recipient, data or expiry and the permit no longer matches.
Execution permit · illustrativevalid
01 · Who
agent id · signed session
02 · Why
stated business intent
03 · What
exact action, one consequence
04 · Where
named target system
05 · Limits
amount · scope · rate
06 · When
valid from · valid until
07 · Validity
issued at · single use intent
08 · Proof
signature · rule hash
permit 0xB204…7A · sig 3F9C…D1Bound
Single use binding and revocation are being proven per workflow with our first partners, not assumed.
Assess · Element 02
04 / 10Inside your rules, or not at all.
The command is weighed against the boundary the business set. That is the go or no go, and it can come back either way. This is the check a risk officer is buying: their rules, applied, before anything happens.
Others can assess. What makes Lokorium an authority rather than an opinion is what happens next, at the point of consequence.
01 · Weighed against
Its data
what may be read, and what may never leave
02 · Weighed against
Its policy
limits, thresholds and who may authorise them
03 · Weighed against
Its regulatory limits
the rules the business already answers to
The rule is always yours. What Lokorium adds is not judgement about your business, it is the one place your rule is applied, in a boundary the agent cannot reach or switch off.
The go or no go · illustrativeit comes back either way
- “Refund £180 to customer 8842”Within refund limitGo
- “Refund £4,000 to customer 8842”Over refund limitNo go
- “Email the full customer table to an outside address”Breaks data policyNo go
Illustrative · the same command at two amounts, then a different boundary entirely
Enforce · Element 03
05 / 10No permit, no action.
This is the part everyone else leaves out. A decision that cannot be enforced is advice. Lokorium applies the decision where the consequence happens, so a second route with different credentials does not get a second answer. The target will not act without valid signed authority bound to that exact command. A refusal is not a warning. It does not run.
Honest note on altitude: enforcement is strongest at target native deployment. Where the target is instrumented to check the permit, the refusal holds. Where it is not, we’ll tell you plainly what the enforcement rests on, per workflow.
Without LokoriumBypass reaches target
Illustrative · scroll to follow the full path
With LokoriumBypass refused at target
Illustrative · scroll to follow the full path
The trust boundarywhere the check has to sit
Guardrails that live inside the agent’s own process share its fate. The check that matters has to happen somewhere the compromised agent cannot reach.
For your security team
The enforcement runs where the agent cannot tamper with it.
The check runs inside a hardware isolated environment using confidential computing and remote attestation. Before it is trusted, it proves it is the approved enforcement code, unmodified, on genuine hardware.
Attestation establishes that the environment is the approved one. It does not certify that a given decision was correct. We keep those two claims separate, on purpose.
If a decision in your business cannot be enforced today, that is the conversation to have.
Prove · Element 04
06 / 10Proof you hold, not proof you borrow.
When a regulator or a board asks how you know, the answer is a record the business holds, spanning every vendor. Not the cloud’s logs. Not the model vendor’s logs. Both are interested parties.
Two artifacts. A chain of five linked records per request. And a ladder that grades the evidence honestly, because a log is not proof.
Evidence chain · illustrativefive linked records
01
Proposal
the intended action
02
Policy decision
rule matched
03
Signed authority
the permit
04
Execution gate
target check result
05
Outcome receipt
what actually happened
Illustrative · records signed and chained
Evidence ladder
A log is not proof. Not all evidence is equal.
The chain is graded. A decision log is the floor. A corroborated outcome, matched against the customer’s own system of record, is the ceiling. We do not pretend a log is proof. We aim, per workflow, for the highest rung the target and the estate allow.
- L4Corroborated outcomethe outcome receipt matched to the customer’s own system of record or telemetry.
- L3Signed outcome receiptthe target’s confirmation, signed and held by the business.
- L2Execution gate resultthe target either accepted the permit or refused, with reason.
- L1Policy decisionthe rule that matched, or the reason none did.
- L0Decision loga proposal was received. Not proof of anything on its own.
Illustrative · graded evidence, per workflow
The record is signed independently. That is the part your business cannot produce for itself, and the part a regulator asks for.
A go or no go, illustrated
07 / 10An action is attempted. A permit is checked at the target. It is allowed or refused. A receipt is written.
The panel below is a concept, not a live product demo. Two example sessions: a legitimate request, then a bypass that tries another route and dies at the target because it has no valid permit.
Session0xB204·idleillustrative
A legitimate request
- 01ingestsupport conversation, signed session
- 02readrefund request, £148.00, account 4471
- 03intentissue refund via billing system
- 04checkconsent on file · daily cap not reached
Allowed with permitLokorium decision. Rule set by the business: refunds under £500 are allowed on accounts with a signed customer consent on file, subject to a daily cap.
A permit is issued, bound to this action. The target accepts it and executes.
receipt 2D91…E5 · held by the businesssealed
That is the whole loop, on one action. Bring us the workflow you cannot sign off.
Why not the tools you already have
08 / 10Permission asks who. Lokorium asks whether.
Most tools in this space answer one question: can this agent act as this user. That is access. It is necessary, and it is not enough.
Who is acting?
Can this agent act as this user. Necessary, and not enough.
Is this allowed?
Is this action, at this value, for this purpose, allowed by the rules of the business.
The gap, in one example · illustrative
A support agent may be authorised to issue refunds. Authorised, and still able to issue a refund of four thousand pounds when the rule says two hundred.
Permission says yes.The business should say no.
And it is not only access. Guardrails in the agent’s runtime, a second model checking the first, a review at midnight. Each is useful. None of them stands at the point of consequence with the authority to refuse, at the moment the action would happen. That is the gap Lokorium was built to stand in.
And the proof answers to you, not to the company that sold you the AI. The referee cannot also be a player. That is the structural position we design toward. Structural, and intended. Not a stamped guarantee.
Success is not everything blocked. It is the right things through, the wrong things caught, and proof of every call.
If you have the tools and still cannot get a yes, tell us what is blocking you.
Who it is for
09 / 10Built for the businesses that can’t afford to guess.
Lokorium starts where control is not optional: regulated enterprise. Financial services, insurance, healthcare, legal, the public sector. The places where the upside of AI is largest and the cost of a wrong action is a headline, a fine, or a licence. For each sector, the one action that would be career ending if the AI got it wrong.
Financial services
FCA scope. Client facing workflows.
Career ending
Moving customer funds or data outside a named, current authority.
Legal
Regulated advice and matter management.
Career ending
Filing or disclosing without a partner sign off, or breaching legal privilege.
Healthcare
Patient data, clinical decision support.
Career ending
Reading, writing to or acting on the wrong patient record.
Insurance
Underwriting, claims, complaints handling.
Career ending
Paying, or refusing, a claim outside underwriting authority.
Public sector
Casework, benefits, citizen services.
Career ending
Issuing a case decision without the delegated authority to make it.
Recognise your sector, and the one action you cannot get wrong? That is where we start. Tell us which workflow.
The sequence
10 / 10Prove it on data. Then it moves into the physical world.
Start where your risk is today, in data and systems. The same control follows your agents as they take on more, and one day the machines that act in the physical world.
Today
Data
Govern what confidential enterprise data is allowed to reach AI, and what AI is allowed to do with your systems and records. This is where control is needed first, and where Lokorium earns its authority.
Next
Agents
As agents take on real tool use, the same authority governs every action they take across your business.
The horizon
Embodied
The same independent authority, deciding what a machine is allowed to do before it acts in the physical world. A far larger opening, earned only once the ground is proven.
A plain exampleIllustrative
Allowed
Bring an adult a glass of water.
Permit matches. Target accepts.
Refused
Bring a child a glass of alcohol.
No matching permit. Target refuses.
Software today, or a robot arm tomorrow. The question is the same in every era: is this allowed to happen, before it happens.
A horizon, not today’s product. Today Lokorium works on the first of the three.
Wherever you are on that path, start the conversation here.
Design partner
partnerBeing built with the businesses that need it most.
Lokorium is being shaped alongside regulated enterprises who are moving on AI now and want the guardrails in place as they go, not bolted on after something breaks.
Early partners help define the rules the market will run on, and get to accelerate into the things their competitors cannot safely touch yet.
Get in touch
closeUnlock enterprise AI, safely.
The capability is here. The control is what’s been missing. Lokorium is the independent authority that lets regulated business move, on every action, with proof of every one.
Tell us where you are stuck, or where you have gone live and cannot yet prove what your AI is allowed to do. We will come back with what a briefing would cover for your exact workflow, in your words, not ours.
Direct email: info@lokorium.com