Your company's brain
Your AI runs
your company's rules.
Not its training data. Not prose. Not hallucinations.
Every answer is a typed function your expert signed.
“Discounts above 10% require VP approval. SDR cap is 5%.”
The primitive
A Ctrl is one signed rule.
Your AI doesn't make decisions. It invokes these.
Every answer your AI gives is the typed output of a function your expert signed. Watch one form, end to end.
Now every AI surface in your company invokes the same Ctrl.
Slack, voice, email, web chat, MCP partners — one signed library, one decision.
Provenance
Click any sentence. See what made it true.
Every factual claim your AI emits binds to the receipt of the Ctrl that produced it. Open the receipt and you see the signers, the post-conditions that passed, and the literal paragraphs the runtime read — signed and hashed alongside.
Q3 ARR is $2.87M against the $4.5M target — a $530K gap. Two deals totaling $415K are flagged at-risk — Acme renewal (champion left) and Brightline (budget freeze).
Recommend doubling down on the two at-risk deals this week and accepting that Q3 lands ~12% under plan.(uncited — synthesis)
- non-negative-arr
- currency-usd
“Total Q3 closed: $2,870,000. Target: $4,500,000. Gap: $530,000 (12% behind plan).”
The drawer your auditor opens is the drawer your team opens.
No separate compliance product. The receipt is the audit trail.
The library
Your company's brain. It grows every day.
Every doc you upload, every rule your expert signs — a new Ctrl, bound to a real human in a real department.
Every AI surface in your company gets smarter together. Green pulses are invocations happening right now.
The hub
Every model. Every system. Every answer. Through your signed library.
Watch an invocation route through your signed library to a specific Ctrl — which decides whether to call a model, pull from data, or both — then return as a typed reply with a sealed receipt.
What makes this different
Every SaaS has AI now. Only one has signed Ctrls.
ChatGPT, Slack AI, Monday AI, HubSpot AI — all run a language model on someone's data. None are signed. None are typed. None can tell you who's accountable.
01 · LLM only
ChatGPT, Claude, Gemini
An averaged voice with no company knowledge.
02 · SaaS AI
Slack AI · Monday AI · HubSpot AI
Each app makes decisions independently. No audit trail. No signed rules.
03 · Ctrl AI
Your signed library
One library. Signed by your team. Invoked from every surface.
SarahMarcusJiaAlexYukiThey build AI on their data.
We build the library your data signs.
The router
The cheapest model that's safe enough.
Every signed Ctrl declares its trust requirement. The router picks the cheapest frontier model that satisfies it.
Most Ctrls run on Haiku — 5× cheaper and 5× faster than Opus. Opus only when the Ctrl explicitly requires it.
BYOK at every tier — your model spend is your bill from your provider, not us. We don't mark up tokens.
Lifecycle
When your docs change, your AI changes.
But only after a human signs.
No silent updates. No drift. When the policy moves, the Ctrls bound to it move to review pending. Your AI keeps the old rules until your expert reads the diff and re-signs. The receipts chain shows every version forever — and every past receipt is replayable against the new policy. Drift shows up automatically, before your auditor asks.
Today
Signed and current
discount-policy v3 is signed. All bound Ctrls are verified.
Ctrls bound to this policy · 3
The standard
Your signed Ctrls live in version control.
A signed Ctrl exports as .ctrl — a canonical YAML file with the schema, the signature, the fixtures, the regulatory citations. Commit it to your repo. PR review for policy. CI fixture runs gate every change. Merge to deploy.
apiVersion: ctrl.dev/v0 kind: Ctrl metadata: slug: commons-kyc-check name: KYC Check (Commons v0) description: | Returns a KYC verification status, including PEP and sanctions screening. version: 1 domain: compliance dataSensitivity: confidential containsPii: true riskClass: high appliesToJurisdictions: [EU, UK, US] satisfiesClauses: - framework: amld6 clause: art-13 spec: inputSchema: { … } outputSchema: { … } implementation: kind: data_lookup connectorId: PLACEHOLDER-kyc-connector toolName: verify postConditions: - id: review-required-on-pep severity: error expr: outputs.pepStatus !== "pep" || outputs.reviewRequired === true fixtures: - name: clear-customer - name: pep-flag-triggers-review signatures: author: userId: usr_sarah signedAt: 2026-05-01T12:00:00Z
- Ctrl AI Fixtures· 3 .ctrl files validated · 6 fixtures green
- typecheck· No type errors
- build· next build · 38s
- lint· 0 errors · 0 warnings
Same artifact your auditor verifies. Same artifact the GitHub Action runs fixtures against on every PR. Same artifact any W3C VC verifier can validate offline.
Cross-org by construction
Audit by graph. Authority by passport.
Every decision an AI makes for your company traces back to the chain of Ctrls that produced it. And every external agent — your consultant's Claude Code, your vendor's Cursor — carries one passport across every client org, with per-Ctrl grants signed independently by each.
Click any answer. See the chain that produced it.
From the receipt drawer → "Why this decision?" → opens /decisions/[invocationId]
One agent. Every client. One passport.
Ed25519-signed by the issuing org. Each client grants per-Ctrl access, independently.
- liveAcme Corp7 Ctrls granted · read · forecast Ctrls
- liveBeta Industries12 Ctrls granted · read · audit Ctrls
- liveGamma Holdings4 Ctrls granted · read · KYC pack
The audit story isn't a separate product.
The Decision DAG falls out of the receipt chain. The grants matrix falls out of the passport table. Compliance is shape, not feature.
Pricing
Every tier ships the same receipts.
Three tiers. The transparency log, the signed Ctrls, the audit trail — every tier gets the full system. Tier is signers and library size, never features.
Team
- ✓Up to 5 signers
- ✓25 signed Ctrls
- ✓Community packs
- ✓BYOK
Company
Recommended- ✓Up to 25 signers
- ✓100 signed Ctrls
- ✓Premium packs (SOC 2, GDPR)
- ✓Slack · voice · email · web · MCP surfaces
- ✓Audit-grade transparency log
Enterprise
- ✓Unlimited signers + Ctrls
- ✓SSO + SAML + audit roles
- ✓Dedicated infrastructure
- ✓Custom packs + co-signed by your experts
- ✓Procurement / DPA / red team support
Start in 60 seconds
Drop a doc.
Be running in 60 seconds.
Upload your first policy. Three signed-Ctrl drafts come back. Sign one — your AI is now invoking your rules. From every surface.
Or fork a Ctrl Commons pack — KYC, AML, sanctions screening, FX, audit-cadence — signed scaffolds you re-sign for your jurisdiction.
Or book a demo