Policy Enforcement
ALLOW, DENY, or ESCALATE decisions based on manifests, budgets, and risk hooks. Non-bypassable enforcement at the action boundary.
Learn more →Human Approvals
High-risk actions escalate to operators for review. Web UI + API with 5-minute SLA. Full audit trail of every decision.
Learn more →Tamper-Evident Logs
Hash-chained, Ed25519-signed interaction records. Cryptographically verifiable audit logs for regulators and courts.
Learn more →See It in Action
Every agent action flows through the gateway for policy enforcement and audit logging.
# Agent proposes action
curl -X POST /gateway/execute \
-H "X-API-Key: $KEY" \
-d '{
"uapk_id": "settlement-bot",
"action": {
"type": "legal",
"tool": "send_settlement_offer",
"params": {"amount": 5000}
}
}'
# Gateway response
{
"decision": "ALLOW",
"executed": true,
"interaction_id": "int-abc123"
}What Just Happened?
- Manifest check — Is settlement-bot registered?
- Capability check — Can it send settlements?
- Budget check — $5K under $50K threshold
- Policy check — Passed all rules
- Executed via connector
- Logged with hash chain + Ed25519 signature
Before vs After
Without UAPK
- Compliance blocks every agent deployment
- "Who authorized this?" — no attribution
- "Can we prove it in court?" — no audit trail
- "How do we stop it?" — no kill switch
- Months of back-and-forth with legal/compliance
- Vendor logs — 90-day retention, not court-admissible
With UAPK
- Policy enforcement: ALLOW / DENY / ESCALATE
- Attribution: Every action traced to agent + manifest
- Court-ready logs: Hash-chained, Ed25519 signed
- Human approvals: High-risk actions reviewed
- Production in 2–4 weeks: Fixed-fee pilot
- Your evidence: Self-hosted, indefinite retention
The "47ers" Library
Pre-built governance templates — drop-in manifests that wire up policy enforcement, approval thresholds, and audit rules for the most common regulated workflows. Deploy in minutes, not weeks.
Litigation & IP
- IP Settlement Gate: Auto-negotiate up to $50K, escalate above
- DMCA Takedown: 200 notices/day with compliance tracking
Trading & KYC
- Trading Gate: $10K auto-execute, $100K daily cap
- KYC Onboarding: Risk-based routing + sanctions screening
Audit & Controls
- Vendor Due Diligence: Automated risk assessment
- Email Guard: Rate limits + recipient validation
Works with Your Stack
Drop UAPK Gateway into whatever automation platform you already use.
The governance stack
Open source gives you the engine. Professional engagement adds expert implementation and legal review from a Rechtsanwalt with 12 years PQE.
UAPK Gateway
Apache 2.0 policy enforcement and audit middleware. Self-host in 5 minutes. All core features free — policy engine, capability tokens, approvals, tamper-evident logs.
Get started →Lawkraft
Expert deployment for regulated environments. Custom AI systems, compliance documentation, and UAPK pilots. No hand-offs, no juniors — delivered by the same person who built the technology.
lawkraft.com →Hucke & Sanker
Boutique transnational law firm. AI Regulatory Strategy practice covering EU AI Act, GDPR for AI/ML, and capital markets compliance. Manifests reviewed as legal instruments by licensed counsel.
huckesanker.com →Simple, Transparent Pricing
Start free and self-host, or engage for expert-led deployment in regulated environments.
Full policy engine, approvals, and audit logs. Run it on your own infrastructure.
- ✓ All core features
- ✓ Apache 2.0 license
- ✓ 47ers template library
- ✓ Docker Compose deploy
- ✓ Community support
Governance design before you build — manifest architecture, policy map, and implementation roadmap.
- ✓ Agent roles + action map
- ✓ Policy manifest design
- ✓ Approval threshold spec
- ✓ Integration architecture
- ✓ Implementation roadmap
Expert-led deployment for one high-value workflow — from kickoff to production.
- ✓ Production-ready manifest
- ✓ Self-hosted on your infra
- ✓ Approval workflows live
- ✓ Evidence-grade audit logs
- ✓ 30-day post-pilot support
Ongoing support for production deployments — custom connectors, SLA, compliance exports.
- ✓ Custom connectors
- ✓ S3 COMPLIANCE audit export
- ✓ 4h SLA, 99.9% uptime
- ✓ Version upgrades
- ✓ Dedicated support channel
All commercial engagements deploy UAPK Gateway to your infrastructure — you own your data, evidence, and compliance posture.
Blueprint fee credited in full toward a Pilot if you engage within 90 days.
Not sure where to start? Book a free 45-min governance assessment →Why UAPK Won't Be Obsolete
Model vendors will improve. Your governance requirements won't change.
Model-Agnostic by Design
UAPK governs actions at the boundary to real systems. It doesn't care which model you use — GPT-4, Claude, Llama, or Gemini.
Regulation Requires It
SOC2, GDPR, SEC audits require organization-owned evidence. "Check the OpenAI logs" doesn't work in court.
Ready to Deploy Agents Safely?
Expert help from David Sanker — Rechtsanwalt, BAFin-certified AI expert, and the engineer who built this for real-world compliance needs
Or explore on your own: