Authority beyond the service account.
Carry the person’s delegated scope and the agent’s identity to each protected operation.
Runtime governance and durable
orchestration
Your agents.
One call.
A governed workflow.
Your agent calls Frozion through MCP or HTTPS. Frozion checks who it acts for, applies your policies, brings in a person when needed and runs the work with connected evidence.
Expose tools, workflows and agents through MCP. Start with one protected resource call, then extend it visually into a durable workflow—without coding or moving your existing agent to a new framework.
Your existing agentYour framework · your language · your platform
One tool call through MCP or HTTPS
FROZIONExecution FabricGoverned from request to outcome
FROZION-MANAGED WORKFLOW
Verify identity & authorityAgent · user · delegated scope
Evaluate nested policiesRBAC · Feature Store facts
Bring in the right personHITL · FIDO2 when required
Wait, revalidate, executeDurable state · governed tools
Identity, policy, and evidence carried through the process
result · execution ID · connected record
Inspect the path from
request to reported result
Included for the agents you already run
Agent identityPer-step RBACVisual policiesHITL + FIDO2Feature StoreDurable stateExecution graph
Kill switch
The AI Control Plane across your adoption path
Govern existing agents
An existing agent invokes a governed operation through MCP or HTTPS.
Grow tools into workflows
One call can run a durable workflow with policy, review and revalidation.
Build native agents
Native agents use the same workflow, policy and execution controls.
Build systems of engagement
Application actions run through the same governed business processes.
At the moment of action
A valid credential isn’t enough
to authorize the work.
An agent can have access to an API and still need a business decision before using it.
Who is it acting for? Does this change meet the rules? Does someone need to approve it? Those checks belong in the process that performs the action.
Business rules in front of the write.
Evaluate the proposed action against current facts and policy before it reaches the resource.
A process behind the call.
Connect the human decision, durable wait, revalidation and outcome instead of leaving each handoff to custom integration.
Keep the agent. Expand what its tools can do.
A tool call can carry
an entire business process.
Start with a governed call to a protected resource. Grow the work behind it as the business process becomes more demanding.
Add conditions, business facts, tools, human review and durable waits in the visual workflow. Tools, workflows and agents can all be invoked through MCP; workflows are also callable over HTTPS.
01 / PROTECT ONE CALL
Govern a tool or API operation.
Expose Frozion-built tools, workflows and agents through MCP. The process can also call external MCP tools, with policy applied before and after each call.
02 / EXTEND IT VISUALLY
Add the process behind the tool.
Connect more tools, rules and reusable facts. Bring in an authorized person when policy requires a decision. Build the workflow visually, without coding.
03 / MAKE THE WORK DURABLE
Carry the same case through the wait.
Preserve workflow state while a person or system is pending. Revalidate before continuing and connect the attempted action to the result the system reports.
You can also build agents and workflows natively in Frozion, then add the application around them with App Builder. Start at the level your use case needs. Frozion governs the operations routed through its execution paths.
Explore one governed tool call
Inside one tool call:
allowed, reviewed or denied.
The agent asks to update a supplier’s bank account. Switch paths to see which controls run, why a decision changes and whether an ERP call happens.
EXISTING AGENT
supplier.update_bank_detailsMCP TOOL · FROZION WORKFLOWAP manager · permitted supplier scope · 0 bank changes in 30 days · proposal r3
SELECT A STAGE TO INSPECT
Authority and policy apply at each governed operation.
STEP 02 / POLICYAllowed
The facts meet the rule.
The AP manager has write authority for this supplier. No bank changes were recorded in the last 30 days, so the finance-review condition does not match.
- Authority
- Policy / decision
- Policy PV-4 requires finance review when bank_changes_30d ≥ 2. This request may proceed without human review.
- Business context
- bank_changes_30d = 0 · source FS-041 · calculation v3 · freshness checked.
- Connected evidence
- CASE-041 · proposal r3 · PV-4 · fact reference FS-041 · decision: allow.
WHAT HAPPENS NEXT
Recheck current conditions before the governed ERP update.
Allowed: authority → policy → revalidation → ERP update → evidence. Human review and the review wait are not required.One connected execution
01 / Identity, authority & policy
Authorize each step.
Inspect each decision.
Starting a workflow does not grant permission to perform every operation inside it.
Apply role-based access controls and business policies to every step that reads data, calls a tool, requests a decision or changes a protected record. The agent's identity, the person it acts for, the tenant, the delegated scope and the purpose travel with the workflow.
A reviewer also acts within an explicit role and scope. Their approval covers the operation they reviewed. It never widens the agent's authority, and a denied action never turns into an approval request.
Explore identity & securityMake the business rule explicit.
Compose nested conditions from actor, role, resource, operation, tenant, purpose and business facts. Inspect the conditions and inputs behind each result.
Explore Visual Policy BuilderDecide with more than one request.
Use counts, totals and rates over time to spot activity that a single call cannot reveal. Evaluate the recorded fact with its source, calculation and freshness.
Explore history-aware rulesControl what comes back.
Inspect tool responses and redact sensitive fields before they reach the agent. Keep the response-policy decision connected to the same execution.
Keep sensitive data out of models02 / Human decisions
When policy needs a person,
the process knows how to wait.
Ready-to-use human review, connected to the workflow.
The HITL Inbox brings the proposal, business facts and evidence to assigned internal reviewers. A real-time case thread keeps the discussion with the decision.
Require FIDO2 step-up where policy calls for it. Bind the approval to the exact revision reviewed, then recheck authority, policy and approval before the workflow continues.
Explore approvals without bottlenecks
FINANCE / SUPPLIER OPERATIONS
Decision required
Review bank-account change
CURRENT ACCOUNTEnding 4821
PROPOSED ACCOUNTEnding 9056
- Requested by
- Procurement agent, acting for an AP manager with bank-change write authority
- Why it needs review
- Two recent bank-account changes trigger the review policy
- Evidence available
- Supplier record, change history, calculated fact, evaluated policy
CASE THREAD · INTERNAL REVIEWERS
Finance reviewer Which supplier confirmation supports proposal r3?
Case owner The confirmation is attached to this revision’s evidence.
Verify the person making this decision
Finance reviewer role + policy-required FIDO2 reauthentication
Approval covers proposal r3. A changed proposal needs a new decision; current authority and policy still apply before the update.
ROUTE THE WORK
A case ready for review.
Give the assigned internal reviewer the proposed operation, its facts and supporting evidence in one case.
STRENGTHEN ASSURANCE
Step up where needed.
Require a FIDO2 passkey for the decisions your policy marks as sensitive.
CONTINUE WITH CONTROL
A decision the workflow can use.
Trace the human decision to the process state, proposed change and evidence of subsequent execution.
03 / Durable orchestration
Coordinate the whole process.
Carry it through interruptions.
A process can outlast the agent invocation that started it.
Visually compose the work behind a tool call: deterministic rules, agent or model tasks, enterprise APIs, events, human decisions, and protected actions. Define the sequence, branches, and exception paths explicitly.
Frozion preserves workflow state independently of the calling agent’s session while a person or external system is pending. Work completed within the response window can return its result; longer-running work has an execution ID for status and results. Before continuation, authority and policy are checked again.
Deterministic logic
Evaluate defined conditions and select repeatable paths.
Agents & models
Interpret, extract, summarize, or propose within the permitted task.
Tools & APIs
Read eligible information and perform authorized operations.
People & events
Wait for decisions, callbacks, documents, or other defined signals.
CONTINUITY WITH CONTROL
Frozion-managed state
Wait → resume → revalidate → act
Keep the business case.
Workflow state and context are held while a review or an external system is pending. Resume the same business execution after the wait.
Check what still holds.
When the process resumes, verify that current permissions, policy conditions, and required approvals still support the proposed action.
Handle uncertain effects.
A downstream timeout can leave a write's result unclear. Configure recovery paths to reconcile the target's reported state or escalate an unresolved outcome before repeating a consequential write.
Model participation is a deliberate choice
Use the right capability for each step.
Use rules where the answer is defined and models where interpretation adds value. First satisfy the task’s capability, quality, privacy and region requirements; then use cost preferences among eligible routes. The Tool Call Resolver/Router presents internal tools, workflows and external MCP tools to the model and supports parameter population over multiple turns before invocation. Track usage by agent, user and workflow, with configured limits on model effort.Explore model and tool routingControl AI cost
04 / Execution evidence
Follow the action.
Understand what shaped it.
Inspect the design before execution. Follow the decision and outcome afterward.
Visual workflows, policies and typed contracts make the intended paths inspectable before they run. After execution, follow tool calls, policy evaluations, human decisions, waits and results through the connected execution graph.
Provenance shows where a fact or record came from. Lineage connects it to the calculated feature, the policy decision and the action that followed. Records are tamper-evident, and each run keeps the workflow, policy and application versions it ran under.
CASE CONTEXTRequest · tenant · initiating identity · workflow
version
01
Source record → calculated fact
Supplier change history informs
bank_changes_30d.
02
Fact → policy result
The evaluated conditions require finance review.
Rule path · input references · policy version
03
Policy result → human decision
An authorized reviewer considers the proposed change.
Reviewer · reviewed operation · assurance result
04
Authorized action → reported outcome
Record the attempted update and the destination response.
Tool call · execution state · result
Inspect evidence within the viewer's permitted scope.
What ran—and what did not?
See the realized workflow path, branches, waits, protected action attempts, and reported results.
Why was this path selected?
Inspect recorded policy conditions, eligible business facts, approvals, and execution events.
Which context applied then?
Inspect the workflow, policy, data and calculation-version references associated with that execution.
The value of an integrated control plane
Governance and execution.
Connected through every step.
Business facts inform policy. Policy can route a human decision. Durable execution carries the process forward, and the execution graph connects the decisions to the reported outcome. Your existing agents can use this whole path.
| Business requirement | How Frozion handles it | Operational benefit |
|---|---|---|
| Complete a business process | Coordinate multiple tools, per-step RBAC, policies and exception paths behind one agent tool call. | Give existing agents a governed execution path without moving them to a new platform. |
| Use business context in decisions | Evaluate deeply nested visual policies against Feature Store facts with source, freshness and calculation version. | Make decisions using relevant business conditions and inspect why a rule matched. |
| Bring in an authorized person | Route the operation and eligible evidence to the HITL Inbox, with FIDO2 step-up where policy requires it. | Connect the human decision to the action it authorizes and the authority needed to perform it. |
| Continue through interruptions | Preserve workflow state, wait for people or systems, and revalidate authority and policy before continuation. | Carry the same execution beyond the calling session, with configured recovery paths for unresolved outcomes. |
| Control what reaches the agent | Inspect tool responses and redact sensitive fields before returning permitted results. | Apply data protection to the response as part of the governed process. |
| Stop further agent actions | Use the kill switch to stop further governed actions, or revoke permission to specific resources. | Contain further activity while retaining the evidence of completed work. |
| Evaluate activity over time | Use Feature Store counts, totals and rates as inputs to policy, with source and freshness attached. | Recognize patterns that a single request cannot reveal. |
| Explain the reported outcome | Connect tool calls, policy evaluations, human decisions, provenance and lineage in a tamper-evident execution graph. | Inspect the path from the original request to the result reported by the target system. |
In your demo, we run all three paths.Your action allowed, routed for human review and approved with a passkey, or denied before the protected call. Then we open the evidence for each.Explore the example ↑
Start with your existing investment
Connect one meaningful action.
Expand from there.
Pick the operation, the systems it touches and the authority it needs.
-
01
Point your agent at Frozion.
Expose a Frozion tool, workflow or agent through MCP, or invoke a workflow over HTTPS. Start with one protected operation and extend its workflow visually as the process grows.
-
02
Define the governed process.
Set up the workflow, per-step roles and policies, business facts, reviewers and recovery paths.
-
03
Watch it run all three ways.
Run the action allowed, escalated and denied, then open the evidence for each.
WHEN YOU WANT TO BUILD MORE
Use the same foundation
Use the same foundation
for the application around it.
Build native agents and workflows in Frozion. Add forms, portals, dashboards, and workbenches through App Builder. Bring eligible data and business context through the AI Data Plane.
Extend the experience into governed business applications or branded SaaS offerings as your product requires.
App BuilderAI Data PlaneGoverned SaaS applicationsFit the environment you operate.
Run Frozion in your data center or your AWS, Azure or Google Cloud account. Connect systems through the API Client Builder and route to the models you approve.
Private & hybrid optionsDeveloper extensibilityQuestions platform teams ask
Questions before
you connect an agent.
Frozion supports MCP in both directions: expose native tools, workflows and agents to MCP clients, and invoke external MCP tools from governed workflows. The Control Plane connects those calls to identity, policy, human decisions, durable waits and evidence. Its Tool Call Resolver/Router lets a model select among internal tools, workflows and external MCP tools and populate parameters over multiple turns before invocation.
Invoke a Frozion-built tool, workflow or agent through MCP, or call a workflow over HTTPS. Your existing agent keeps its framework. Workflows can also invoke external MCP tools, applying policy before and after the call. The API Client Builder connects the governed workflow to downstream systems.
Yes. Start with a protected resource call, then add tools, conditions, business facts, human review and durable waits in the visual workflow without coding. When the tool’s input/output contract remains compatible, the calling agent can keep using the same interface as the process grows.
No. Existing agents get the full control plane: agent
identity and delegation, nested policies, the HITL Inbox
with FIDO2 step-up, Feature Store facts, durable execution
and the execution graph. Building agents and applications
in Frozion is there when you want it.
No. Each operation inside the workflow is authorized on
its own: data access, tool calls, human decisions and
protected changes. Starting a workflow doesn't authorize
what follows, and authority, policy and approval are
checked again right before every governed write.
Frozion preserves workflow state independently of the
calling agent's session. If execution completes within the
configured response window, the caller receives the
result. For longer-running work, the agent can retrieve
status and results using the execution ID. Authority and
policy are checked again when execution resumes.
No. Policy lets routine work proceed, denies what isn't
allowed, and escalates only the operations that need
judgment. FIDO2 passkey step-up applies wherever your
policy calls for stronger assurance.
Before execution, inspect visual workflow paths, policies, typed contracts and their connected definitions. Afterward, inspect tool calls and responses, evaluated facts, policy decisions, approvals, waits, model usage and outcomes, with their versions and lineage. Evidence is tamper-evident, exportable and available through scoped read-only access for auditors.
The AI Control Plane runs governed agents and workflows.
App Builder provides the forms, portals, dashboards and
workbenches around them, while the AI Data Plane supplies
governed data and business context. They share an identity
and authority model, so you can start with an existing
agent and expand into a complete application.
Start with the work your agent needs to do
Bring one tool call.
See the process it could become.
We'll map the steps, permissions, business facts and
approvals
for your first governed workflow, then run it
allowed, escalated
and denied.