AI agents now take real, irreversible actions inside core enterprise systems — payments, KYC, CRM, data export — at machine speed. There is no independent control point deciding whether those actions should proceed.

Today's guardrails live inside the model or inside the application. That places the referee on one of the teams: the vendor whose agent takes the action also grades whether it was allowed. And asking a language model to police itself is probabilistic, not reproducible, not version-controlled, and unprovable to an auditor.

A wrong sentence is embarrassing. A wrong action is money moved, data leaked, or a regulation breached — and the enterprise, not the model vendor, carries that.

Crelis is an AI governance control plane that sits between the agent and the system it wants to act on.

Every request passes through a canonical envelope that normalises any source into one format. A deterministic policy engine evaluates it against native and customer-defined policies and returns one of four outcomes: allow, require human approval, route to a specialist, or block. Each decision carries an explainable reasoning trace and is written to a hash-chained, tamper-evident audit log.

The decision is never made by a language model. That is enforced structurally — an automated boundary test fails the build if any LLM SDK becomes reachable from the decision path — so "deterministic" is a property of the system, not a claim in a deck.

Where an action needs authority to proceed, Crelis issues a short-lived, single-use cryptographic execution grant bound to the exact action and to the head of the audit chain. The endpoint trusts the certificate, not the AI.

Live today: the trust engine, the control plane with RBAC and tenant isolation, plain-English policy authoring, human approval workflows with SLA tracking, and export of the signed record into the customer's own SIEM.