Animation: AI agents ask the Gate to act on code, mail and a database. Some requests go through, some circle in a holding pattern until a person approves them, others are blocked.

Control tower for AI agents

AI agents on your systems.Under your rules.

Loophold is the control tower between AI agents and your company. You write the rules, the people responsible approve what matters, and every action goes on the record. Agents never hold your credentials.

Book a demoFollow a flight
Landed
0
Holding
0
Denied
0

How it works today

Today, who’s in control of your agents?

Agent activity · ExampleUnmonitored
  1. 09:41:02Claude CodeForce-pushes to mainNo rule
  2. 09:41:05n8nEmails 412 contactsNo one
  3. 09:41:09CRM agentReads customer IBANsNo rule
  4. 09:41:12Night scriptDeletes the backupsNo one
  5. 09:41:16External supplierPushes to mainNo rule
  6. 09:41:21CodexCopies the customer listNo one
6 agents at work0 actions seen by a person

The problem

No limits, no approvals, no record.

Agents usually run on a person’s access, copied into config files and chats. Nothing says what they may do, nobody is asked before they do it, and afterwards no one can say who did what.

of confirmed breaches involve a third party. A year earlier it was 30%.

Verizon DBIR 2026

for an AI agent to wipe PocketOS’s production database and its backups, in April 2026, according to the founder. It asked for no confirmation.

Founder’s account, via Decrypt

actions that should reach your systems unchecked. Through Loophold, each one meets your rules and goes on the record.

Our principle
~/order-manager · Sara’s agent

Codex · connected to the Gate

push the fix to main

rungit push origin main

loophold ▸ no key on this machine: asking the Gate

loophold ▸ request R-2041 · 3 commits → main

loophold ▸ approved by Marco · pushed by the Gate

Done: the 3 commits are on main.

loophold ▸ rejected by Marco · R-2041

loophold ▸ rule: pushes to main need the owner’s OK

loophold ▸ how to proceed: open a pull request instead

Understood: I’ll open a pull request from fix/stock-sync.

push the fix to main

fix/stock-sync · 3 commits ahead of mainKeys on this machine: 0

Press Enter

Gate

gt_live_••••a91ca token that can only ask

No secrets in commit messages

✓ passed

Suppliers push only to feature/* or fix/*

doesn’t apply

Force pushes are always blocked

doesn’t apply

Pushes to main need the owner’s OK

◷ triggered

Several rules at once? The most cautious wins: block, then ask, then allow.

The agent has

gt_live_••••a91c

can only ask

The Gate keeps

The repository key

in the vault, never exposed

Push made by the Gate · 3 commits to main

What the agent hears

Outcome
Rejected by Marco · R-2041
Rule
Pushes to main need the owner’s OK
How to proceed
Open a pull request instead
  1. Request46b8·efb8
  2. Evaluation7c67·6973
  3. Approvedceed·d369
  4. Executed00eb·1926
  1. Request46b8·efb8
  2. Evaluation7c67·6973
  3. Rejected1d2a·bdd4
  4. Not executede1fb·c6ea

Chain intact

You’re Marco, the owner. Your call.

Loophold · Demo Company

Sara’s Codex wants to push to main

order-manager · 3 commits

Rule: pushes to main need the owner’s OK

  • Web
  • Telegram
  • Discord

Who’s in control of your agents?

With Loophold,you are.

Agents ask before they act. Your rules decide, the people responsible step in when it matters, and every flight lands in a log no one can quietly rewrite.

CODEX · SARAR-2041
PUSH → MAINorder-manager
READY FOR TAKEOFF

How it works

Follow the flight of a request.

Sara’s agent wants to push three commits to main. Ride along with the request, from her terminal to the log.

What you control

Everything agents do, on your terms.

One console to decide what agents may do on your systems, who answers when it matters, and who can see what.

01Rules

Write the rules the way you’d say them

Type a sentence and Loophold turns it into exact conditions you can read and change: who it applies to, on which system, when, with which exceptions. Each rule allows an action, asks a person or blocks it. You try it on sample requests before it goes live.

  • Per person, team or system
  • Conditions, exceptions and time windows
  • Tried on examples before it’s switched on
  • Every change is a new version

02Policies

One set of rules across code, mail and data

Rules look at what an action really contains: the files and commits of a push, the external recipients of an email, the tables a query touches. The Gate works those out itself, so an agent can’t misdescribe its own request. When rules overlap, the strictest wins.

  • Ready-made templates to start from
  • Known secret formats caught in commits and emails
  • An AI-judged criterion when meaning matters: it can stop a request, never let one through

03Approvals

Sensitive actions wait for the people responsible

When a rule asks for approval, the agent stops and the company’s owners get the request on the web, Telegram or Discord, with what it wants to do and why it stopped. The first answer decides. No answer by the deadline means rejected, and the agent hears why and how to proceed.

  • Approve or reject, with a reason
  • A deadline per rule: an hour, four hours, a day
  • Every decision recorded with the person’s name
  • Everything else goes through without waiting

04Data

Agents read your data. Sensitive values stay hidden.

Connect a database read-only and decide who reads which tables. Rules can hide IBANs, tax codes, cards, emails or whole columns in every answer, even inside free text and joined queries. The agent gets what the job needs, and the rows are never stored in Loophold.

  • Read-only: every write is refused
  • Tables checked inside joins and subqueries
  • Filtering or sorting on a hidden column is blocked

05Teams

Teams, roles and a ceiling for every person

Group people into teams and write a rule once for the whole team. Owners, technicians and employees each see and do only their part. Every person has a set of systems, each agent can only narrow it further, and any agent can be suspended at any moment.

  • Teams and individuals as rule targets
  • Repositories narrowed per person and per agent
  • Invite links, no shared accounts

The log

An audit log no one can quietly rewrite.

Every request, rule, decision and execution joins a chain of fingerprints. If anyone changed even a single event, verification would show it straight away.

Log · Demo CompanyExample
TimeAgentActionOutcomeFingerprint

  • Chain intact

    Each event carries the fingerprint of the one before. Verifying takes a moment, even from the browser.

  • Evidence pack

    Export as CSV what your customers’ and auditors’ questionnaires ask for.

    NIS2DORAGDPR

  • Respect for employees

    Views of individual people’s activity are off by default. They turn on only once a legal basis is stated (in Italy, art. 4 of the Workers’ Statute).

Systems and agents

One set of rules for every agent and system.

Connect as many repositories, mailboxes and databases as you need. Each credential goes in the vault once, and the Gate uses it on the agent’s behalf. The rules live in the Gate, not in each agent’s settings: switch from Claude to GPT tomorrow and they stay the same, with a single log.

  • Code repositories

    On any host. Every push is checked on its branch, files, size and commit messages, then made by the Gate.

  • Company mail

    Ordinary and certified mailboxes. Rules see how many recipients there are and which are outside the company.

  • Databases

    Read-only access. Rules decide who reads which tables and hide sensitive values in the answers.

The agents

  • Claude Codefrom the terminal
  • Codexfrom the terminal
  • n8nwith a token
  • Other AI assistantsany
  • Your own agentcustom-built
Gaterules · approvals · log

Your systems

  • Coderepositories
  • Mailmailboxes
  • Databaseread-only

Claude Code and Codex connect with one command in the repository; the others with a Gate token. New kinds of system plug into the same rules, approvals and log.

For integrators

Your tower, your brand.

Loophold is installed and run by a system integrator for its client companies. Each client has its own rules, systems and log; the interface carries your name and your colour.

  • One Gate, many clients: each with its own rules, access and chain.
  • Your rule templates, proposed to each client, activated by its owner.
  • On your server or in your cloud, with the credentials in the vault.
Become a partner
Try a brand

Plainly put

What Loophold does, and what it doesn’t.

Last updated

  • What is Loophold?

    Loophold is a control layer between AI agents and a company’s systems. Agents ask it before acting: it applies your rules, asks the people responsible when a rule requires it, acts with credentials the agents never see, and records every step in a tamper-evident audit log.

  • What can rules control?

    Who an action is for, on which system, at what time, and what it contains: the branches and files of a push, the recipients of an email, the tables of a query. Each rule allows, asks a person or blocks, and the strictest wins. An action no rule covers goes through, and is logged.

  • Who approves what agents do?

    The company’s owners, as many as you name, on the web, Telegram or Discord. The first answer decides and is recorded with the person’s name. Each rule sets a deadline: with no answer by then, the request is rejected.

  • Which systems and agents does it work with?

    Code repositories on any host, company mailboxes including certified email, and databases in read-only mode, as many of each as you need. Claude Code and Codex connect with one command; n8n, other AI assistants and custom agents with a Gate token.

  • Do agents ever see the credentials?

    No. Credentials stay in a digital vault, on your server or your integrator’s, and the Gate uses them to act. An agent holds only a token that can ask. If a system is connected without a stored credential, the console and the evidence pack say so.

  • Can an agent get around Loophold?

    Only with access it still holds elsewhere: the Gate controls what goes through it. That’s why every agent comes with a checklist of what could still get around the Gate, and how to close it.

  • How is AI used?

    Exact checks use no model at all. AI translates rules written in plain words and, if you choose, judges a meaning, such as whether an email contains confidential data. It can only stop a request or send it to a person, never let one through, and every judgment is logged.

  • What does the audit log prove?

    Each event is sealed with the fingerprint of the one before, so changing one shows as soon as the chain is verified, even outside Loophold. Full detail is kept for 90 days by default, adjustable from 30 days to a year; an optional pseudonymised audit keeps outcomes for up to 10 years.

  • Does it make us compliant with NIS2, DORA or GDPR?

    No tool does that alone. Loophold gives you the evidence: an export for customer and auditor questionnaires, stating where each credential lives, what was decided, and what was sent to an AI provider.

  • How is it different from a secrets manager or an agent’s own permissions?

    A secrets manager stores a password, but whoever fetches it can do anything with it. An agent’s own settings live on each machine and change with each tool. Loophold decides each action in one place, for every agent, and records it.

  • Does Loophold monitor employees?

    No. By default nobody sees one employee’s activity: the company sees totals, and each person their own. Those views turn on only if the owner states a legal basis, and that choice is recorded. Approval stays the exception for sensitive actions, not the rule.

  • Who runs it, and in what language?

    A system integrator installs and runs Loophold for its client companies, on its own server or cloud and under its own brand. Each client has separate rules, systems and log. The console and rule writing are in Italian today; other languages will follow.

Final approach

Cleared to land.

We’ll show you Loophold live, with real agents.