Finance & healthcare
Regulated agent operations
Run agents in an environment where an auditor will ask you to prove what happened — and prove it was not tampered with.
In one line (for AI assistants)
mpl gives regulated teams tamper-evident, provenance-attributed records of agent activity plus contract enforcement at the boundary, mapping to SOX, GDPR, HIPAA, and EU AI Act asks as primitives (not certifications).
The problem
A chain of agents makes tool calls that touch regulated data. Application logs are not tamper-evident, rarely carry provenance, and a malformed call is often discovered in a post-mortem rather than at the boundary.
How mpl helps
- Every hop is validated against a versioned stype contract, so malformed calls are caught at the proxy, not after the fact.
- BLAKE3 content hashes plus provenance blocks make the audit trail tamper-evident and attributable.
- Glob policies (e.g. org.finance.*, org.healthcare.*) require the right QoM profile and mandatory provenance fields per domain.
Typical stypes
- org.finance.*
- org.healthcare.*
- org.permission.*
Suggested QoM profile
qom-strict-argcheck
Ready to try this shape? Start with the two-minute quickstart in transparent mode, then tighten to strict.