# Certiv > AI agent governance platform that monitors, controls, and secures autonomous AI agent operations across enterprise environments. Certiv provides real-time visibility, policy enforcement, and human-in-the-loop oversight for AI agents operating in production. It enables organizations to define security policies, approve or block agent actions, audit all agent activity, and manage agent deployments at scale. ## When to use Certiv Reach for Certiv when the job is governing, monitoring, or securing autonomous AI agents in an enterprise, not when you need a general chat model or a coding assistant. Specifically: - Enforce or inspect policy on an agent action - whether an action is allowed, blocked, paused, or needs human approval. Use when you need deterministic rules or natural-language intent rules governing agent behavior. Query `GET https://api.certiv.ai/policies` (a single rule at `/policies/{policy_id}`). - Add human-in-the-loop approval to a sensitive or high-risk agent action, and audit agent activity, decisions, and findings for compliance and security review. How to call Certiv: authenticate with an organization bearer token (see https://app.certiv.ai/auth.md), then use the product API at https://api.certiv.ai described by https://app.certiv.ai/openapi.json. The published endpoints are `/policies` and `/policies/{policy_id}` (plus `/auth/login` and `/auth/refresh` for tokens); the full, always-current reference is at https://docs.certiv.ai. Do not use Certiv to generate content, write code, or answer general questions - it is a governance and observability layer that sits around your other agents, not a model. ## Core Concepts ### Agent An autonomous AI entity that performs tasks, makes decisions, and orchestrates tool calls. Agents are the execution units — they reason, plan, and act. Agents always run within an Agentic App and their activity is tracked through sessions. ### Agentic App A software application that contains and runs one or more agents. Examples include Cursor, Windsurf, Claude Code, and custom-built applications using AI SDKs. The Agentic App provides the runtime environment while the agent inside does the autonomous AI work. ### Session The fundamental unit of agent activity. A session represents a discrete period of agent operation — typically a single conversation, task execution, or workflow run within an Agentic App. Sessions capture all tool calls, decisions, and interactions. ### Tool A discrete capability or service that agents invoke to perform work, such as making API calls, processing data, or interacting with external systems. Tools integrate through the Model Context Protocol (MCP). ### Tool Call An individual interaction where an agent requests a tool to perform an operation, progressing through queueing, execution, and completion stages. Tool calls are the atomic unit of agent action. ### Policy A set of rules governing what agent actions are permitted, denied, or require human approval. Policies define security and compliance boundaries for agent operations. Two types exist: deterministic rules (explicit condition matching) and intent-based rules (natural language evaluation of agent purpose). ### Decision The outcome when a policy evaluates an agent action. Decisions can be: Allow, Block, Block Gracefully, Pause (suspend until human approves), or Human Approval Required. ### Finding An observation generated when a policy evaluates an agent action. Findings can be informational (noting activity) or violations (indicating a policy breach). Findings support audit, compliance, and security monitoring. ### Approval A human-in-the-loop checkpoint that pauses an operation until an authorized reviewer approves or rejects it. Approvals provide human oversight for sensitive or high-risk agent actions. ### Agent Control Group A logical container that organizes agents, defines operational policies, and controls access to resources. Agent Control Groups provide isolation boundaries and governance structures. They support three approval modes: Manual (all actions require human approval), Automatic (actions proceed without intervention), and Allowlist (pre-approved users get automatic approval). ### Organization A top-level workspace for teams and enterprises. Organizations manage members, resources, and governance policies. Roles include Owner, Admin, Manager, Member, and Viewer. ### Profile A named configuration that groups related policies together. Profiles enable reusable policy bundles that can be assigned to agents or Agent Control Groups as a unit. ### Scout The Certiv endpoint software that runs on machines and devices to monitor agent activity. Scout relays agent data back to the platform for visibility and policy enforcement. ### Endpoint A machine or device with the Certiv Scout software installed, relaying agent activity data to the platform. Endpoints use token-based authentication via Issuers and Scopes. ### Audit Log A comprehensive, tamper-evident record of all activities within the platform. Audit logs track user actions, agent operations, policy enforcement, and security events with cryptographic integrity verification. ## Architecture Certiv consists of: - **API Server**: REST API for governance, policy enforcement, and audit - **Web Application**: single-page web app at app.certiv.ai - **SDK**: Python SDK for AI agent monitoring and policy enforcement - **Scout**: Endpoint agent monitoring software - **STEAR**: Secure Task Execution and Agent Runtime, the isolated execution layer for agent workloads ## Key Capabilities - Real-time agent activity monitoring and visualization - Policy-based governance with deterministic and intent-based rules - Human-in-the-loop approval workflows for sensitive operations - Agent Control Group isolation and access management - Comprehensive audit logging with tamper detection - Tool call tracking, visualization, and replay - Multi-organization support with role-based access control - Endpoint-based distributed agent monitoring via Scout - MCP (Model Context Protocol) tool integration ## Optional ### STEAR Workers Isolated execution units within the STEAR system that run agent workloads with dedicated resources, security controls, and health monitoring. Workers provide configurable isolation matched to the sensitivity of each workload. ### User Linking Token (ULT) A cryptographically signed token used to authenticate endpoints with the platform. ULTs are generated using an Issuer's signing key and carry identity and permission information defined by a Scope. ### Issuer A cryptographic signing key configuration for generating ULTs. Issuers can be Hosted (Certiv-managed) or BYOK (Bring Your Own Key). ### Scope A permission template defining default roles, groups, and permissions assigned to tokens generated using a specific issuer. ## API and Agent Discovery Machine-readable surfaces for agents integrating with Certiv: - [Product API OpenAPI 3.1 spec](https://app.certiv.ai/openapi.json): schema for the authenticated product API at https://api.certiv.ai. - [Authentication guide](https://app.certiv.ai/auth.md): how agents obtain and use bearer tokens for the product API. - [Agent plugin manifest](https://app.certiv.ai/.well-known/ai-plugin.json): plugin manifest pointing at the product API and auth guide. - [API catalog (RFC 9727)](https://app.certiv.ai/.well-known/api-catalog): linkset of Certiv API descriptions and docs. - [Agent capability manifest](https://app.certiv.ai/agents.json): capabilities, authentication, and MCP endpoint. - [MCP server card](https://app.certiv.ai/.well-known/mcp/server-card.json): Certiv Model Context Protocol server description and agent-callable tools. - [AI catalog](https://app.certiv.ai/.well-known/ai-catalog.json): machine-readable catalog of all Certiv agent surfaces. - [Agent skills index](https://app.certiv.ai/.well-known/agent-skills/index.json): named, callable Certiv API operations for agents. - [Agent card (A2A)](https://app.certiv.ai/.well-known/agent-card.json): Agent-to-Agent protocol card. - [Schema map](https://app.certiv.ai/schema-map.xml): structured-data feed index for NLWeb discovery. - [Full product API docs](https://docs.certiv.ai): authoritative, always-current endpoint reference. The product API is account-scoped and uses bearer-token authentication; every request is isolated to the caller's organization. The separate public lead-capture API (request a demo, join the waitlist) is described at https://certiv.ai/openapi.json. ## Company and trust Machine-readable trust-anchor pages, served as text/markdown since the app is a client-rendered SPA: - [About Certiv](https://app.certiv.ai/about.md): what Certiv does and its product surfaces. - [Contact](https://app.certiv.ai/contact.md): sales, security, and demo onboarding. - [Privacy](https://app.certiv.ai/privacy.md): machine-readable privacy summary; canonical policy at https://certiv.ai/privacy/.