UAPK Gateway

Policy Enforcement

ALLOW, DENY, or ESCALATE decisions based on manifests, budgets, and risk hooks. Non-bypassable enforcement at the action boundary.

Learn more →

Human Approvals

High-risk actions escalate to operators for review. Web UI + API with 5-minute SLA. Full audit trail of every decision.

Learn more →

Tamper-Evident Logs

Hash-chained, Ed25519-signed interaction records. Cryptographically verifiable audit logs for regulators and courts.

Learn more →

Where do you start?

Three paths into UAPK — pick the one that matches where you are right now.

⌨

I'm technical

Set up the full policy engine, capability tokens, and audit logs on your own infrastructure.

FreeDocker / CLI setup

View Quickstart

⚖

I need governance design first

Design manifest architecture and policy map for your agent before writing a line of code.

€5K–€10K1–2 week engagement

Get in Touch

Most common

🚀

I need one workflow live fast

Expert-led deployment from kickoff to production for one high-value regulated workflow.

€15K–€25K2–4 week pilot

Book a Pilot

See It in Action

Every agent action flows through the gateway for policy enforcement and audit logging.

# Agent proposes action
curl -X POST /gateway/execute \
  -H "X-API-Key: $KEY" \
  -d '{
    "uapk_id": "settlement-bot",
    "action": {
      "type": "legal",
      "tool": "send_settlement_offer",
      "params": {"amount": 5000}
    }
  }'

# Gateway response
{
  "decision": "ALLOW",
  "executed": true,
  "interaction_id": "int-abc123"
}

What Just Happened?

Manifest check — Is settlement-bot registered?
Capability check — Can it send settlements?
Budget check — $5K under $50K threshold
Policy check — Passed all rules
Executed via connector
Logged with hash chain + Ed25519 signature

Reference deployment

IP settlement agent — from proposal to evidence

A law firm's settlement bot needs to negotiate IP disputes autonomously — but compliance requires human approval above €50K and a court-admissible audit trail for every action taken. This is what one gateway execution looks like end-to-end.

Action proposed

Settlement bot calls POST /gateway/execute with action type legal, tool send_settlement_offer, amount €5,000 toward counterparty in an IP dispute.

Policy engine runs

Gateway checks manifest identity, capability token, amount against the €50K threshold, jurisdiction allowlist, and daily budget. All pass. Decision: ALLOW.

Connector executes

HTTP connector sends the offer via the firm's outbound API. Response captured and attached to the interaction record.

Audit record written

Tamper-evident record created: request hash, result hash, Ed25519 gateway signature, and SHA-256 link to the previous record in the chain.

Evidence bundle ready

Compliance team exports the S3 Object Lock bundle. The chain integrity check passes. The record is court-admissible and regulator-ready.

Outcome: Compliance signed off in week one of the pilot. Audit records passed chain integrity verification. The evidence bundle met the standard required for court submission. Settlement offers above the €50K threshold trigger an escalation to a human approver before execution — the bot never touches those unilaterally.

See how a pilot works →Browse governance templates →

Before vs After

Without UAPK

Compliance blocks every agent deployment
"Who authorized this?" — no attribution
"Can we prove it in court?" — no audit trail
"How do we stop it?" — no kill switch
Months of back-and-forth with legal/compliance
Vendor logs — 90-day retention, not court-admissible

With UAPK

Policy enforcement: ALLOW / DENY / ESCALATE
Attribution: Every action traced to agent + manifest
Court-ready logs: Hash-chained, Ed25519 signed
Human approvals: High-risk actions reviewed
Production in 2–4 weeks: Fixed-fee pilot
Your evidence: Self-hosted, indefinite retention

Who should buy this first?

UAPK is built for one specific problem: AI agents taking consequential, externally-visible actions in regulated environments.

Best first fit

✓Legal ops agents (settlement, due diligence, contract review)
✓KYC / AML onboarding workflows with sanctions screening
✓Internal agent approvals for regulated outbound actions
✓Finance agents writing payments, transfers, or trade orders
✓Any AI system where "what did it do and who approved it?" matters to auditors

Not ideal first fit

–Casual chatbots or Q&A assistants with no external actions
–Generic content generation or summarisation pipelines
–Low-risk internal copilots with no regulatory exposure
–Agents that only read data and never write or send anything

The "47ers" Library

Pre-built governance templates — drop-in manifests that wire up policy enforcement, approval thresholds, and audit rules for the most common regulated workflows. Deploy in minutes, not weeks.

Legal

Litigation & IP

IP Settlement Gate: Auto-negotiate up to $50K, escalate above
DMCA Takedown: 200 notices/day with compliance tracking

View templates →

Finance

Trading & KYC

Trading Gate: $10K auto-execute, $100K daily cap
KYC Onboarding: Risk-based routing + sanctions screening

View templates →

Compliance

Audit & Controls

Vendor Due Diligence: Automated risk assessment
Email Guard: Rate limits + recipient validation

View templates →

Works with Your Stack

Drop UAPK Gateway into whatever automation platform you already use.

View Integration Docs →

The governance stack

Open source gives you the engine. Professional engagement adds expert implementation and legal review from a Rechtsanwalt with 12 years PQE.

Governance infrastructure

UAPK Gateway

Free · Open Source

Apache 2.0 policy enforcement and audit middleware. Self-host in 5 minutes. All core features free — policy engine, capability tokens, approvals, tamper-evident logs.

Get started →

AI consulting & implementation

Lawkraft

Pilot · Blueprint

Expert deployment for regulated environments. Custom AI systems, compliance documentation, and UAPK pilots. No hand-offs, no juniors — delivered by the same person who built the technology.

lawkraft.com →

Legal review & regulatory strategy

Hucke & Sanker

Enterprise · Ongoing

Boutique transnational law firm. AI Regulatory Strategy practice covering EU AI Act, GDPR for AI/ML, and capital markets compliance. Manifests reviewed as legal instruments by licensed counsel.

huckesanker.com →

Who built this and why →