Play · Security teams
Prove EU AI Act human oversight
Article 14 isa hold verdictwith a name on it.
Set a human approval policy on the actions a high-risk use touches, and the agent waits for a person who gets the full context in Slack or the Waxell workspace. The decision, the decider and the reason land in the record, and the compliance pack maps it to the Act.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF
Who
A security and compliance team with agents in scope for the EU AI Act's high-risk obligations, and a date to show oversight that works.
What happened
Legal asked for evidence that a person can intervene before an agent acts on an applicant, and the only artifact anyone could find was a process document.
What's at stake
An obligation to show human oversight and record-keeping, met with documents rather than records, in front of a regulator who asks for the latter.
- 01Enforce
Hold for a person where the Act says a person must be able to intervene.
Pick the actions: a decision on an applicant, a message to a customer, a write to a system of record. A human approval policy holds each one and routes it to a named person in Slack or the Waxell workspace with the agent, the action and the context. The action waits until they answer. Whether the agent reaches its tools through the MCP Gateway or a Waxell policy hook, the hold applies the same way, and a kill switch sits beside it for the case where the answer is to stop the agent.
verdict: hold · approvals in Slack or the workspace · kill switch · 50+ policy categories
govern · policies
- 02Prove
Record-keeping that is the record.
Each held action carries who approved it, when and why, beside the policy that held it. That is Article 12 record-keeping, written as it happens. The one-click compliance pack maps per control to the EU AI Act with the governance event log and an Ed25519-signed attestation. Retention is configurable per data class up to seven years, with legal hold.
per-control mapping to the EU AI Act · governance event log · Ed25519-signed attestation · retention to seven years with legal hold
insights · compliance pack
- 03Prove
Gaps shown as gaps.
The pack names the policies and records behind every control and shows a control with nothing behind it as a gap, so the first export tells you what to turn on before a regulator does.
gaps shown as gaps · ISO/IEC 42001 and NIST AI RMF from the same record
insights · compliance pack
- decision.write · outcome: declinecredit-triage · application 20418 · human approval · routed to m.kellerhold
- approved decline · application 20418m.keller · income verification failed · reviewed in fullallow
- email.send · applicantcredit-triage · application 20433 · human approval · routed to m.kellerhold
- model.invoke · scorer-v3credit-triage · scorer-v3 · model card required · none on fileblock
Illustrative entries in the shape the product writes them.
Products in this play
No. The hold is a policy decision on the action, so it applies wherever Waxell sits between the agent and the action: the MCP Gateway for tool calls, a governance hook in a hosted agent, or Runtime if you build the agent yourself.
Run this play this week.
Free for your first agents and devices, live in about thirty seconds. Or walk through it with someone who has run it before.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF