INSTRUXIENFORCER GOVERNOR LIVE DEMO · the real checks, running in your browser See the dashboard
$0.00
spent so far
0
allowed
0
blocked
0
escalated
intact
records

Autonomous, not unaccountable.

Let them run. Watch every action as it happens, step in when it matters, and keep a record nobody can quietly edit. Every action passes one check first: inside its limit and on task? allow · over it, or stuck in a loop? deny · needs more to finish? escalate to you. A denied action never executes, so nothing is spent on it. Flip the switches below and watch your agents react live.

It knows when the model is wrong for the job

It reads the task you actually typed. Running the test suite on your priciest model gets you told, and so does debugging a race condition on the cheapest one. It moves one tier at a time, and says nothing when it is unsure.

It catches a runaway by its speed

Everything else caps a total, which only notices once the money is gone. This watches dollars a minute. A session fanning out into fifty subagents is stopped inside the first minute, not after four figures.

It judges what an agent may DO

Not only what it may spend. Piping the internet into a shell is refused outright. Deleting a tree, rewriting git history, reading your credentials: those stop and ask you. All cheap commands, so a spend cap never sees them coming.

Every decision leaves a receipt

Hash-chained, naming the human it acted for, the tool it tried, the model answering and the rule that decided. Edit or delete one record and the chain breaks and says which line. Export the lot as a spreadsheet.

It splits the bill by client on its own

Five projects for five clients, and nobody has to label a session. It reads the folder the work is happening in. Cap a client for the month and that one stops while the other four carry on.

1

Watch it work. Each card is an agent running right now: what it was asked to do, which model is answering, and what it has cost. Green means healthy. The dashed line is where it stops and asks you.

2

Step in. Within a minute, scraper-07 gets stuck repeating itself. It is stopped on the fourth repeat, long before you would have noticed. You can stop any of them yourself, any time.

3

Check the record. Every decision is receipted and chained together. Approve or deny when an agent asks, and your call is recorded too. Change one record and the chain visibly breaks: press Check the records.

What your agents may do checked before anything is spent
pipe the internet into a shellrefused
delete a whole treeasks you
rewrite git historyasks you
read or write credentialsasks you
publish or deployasks you
A spend cap has no opinion on curl | sh, on rm -rf, or on reading your .env, because all of them are cheap. These fire on a full budget. Watch scraper-07 try one below.
Your agents watch scraper-07 catch its own loop · approve research-swarm-03 when it asks

These cards are the real thing. The dashboard is where you set what they may spend and what they may do.

See the dashboard
Every decision, receipted allow deny escalate
Rules these are the live rules, not settings for later
when it nears the limit:
ENFORCER OFF · agents are executing with no budget check, no waste detection, and no receipts. Gauges will blow past their caps. This is how most agent fleets run today.
One control halts every agent mid-flight. The stop itself is receipted: who pulled it, and when.
It also tells you when the model is wrong for the job.

Running the test suite on your most expensive model is the commonest way to overspend without noticing. It happens on Claude, on ChatGPT, on Gemini and on Grok alike, and Enforcer checks all of them the same way. Here is exactly how it decides.

  1. It reads the job and the model. Two facts, from wherever your agent keeps them: the instruction a person actually typed, and which model answered it. Coding agents write both into their session transcript; anything on an API announces the model in the response. Enforcer takes them from there and infers nothing about you.
  2. It matches the wording against two fixed sets of patterns. Reasoning work looks like why, debug, root cause, architect, investigate, trade-offs, migrate. Mechanical work looks like run the tests, lint, bump the version, fix the formatting, update the changelog. No model is judging another model here, so there is nothing to talk around, and the same words always give the same answer.
  3. It moves one step, never two. Every family has its own ladder and it stays inside yours: Fable to Opus to Sonnet to Haiku on Claude, GPT-5.6 down to GPT-5 mini on ChatGPT, Gemini Pro to Flash to Flash Lite, Grok 4.6 down to Grok Build. Mechanical work on a top model comes down one. Reasoning work on a light one goes up one. Reasoning wins any tie, and if the wording is ambiguous it says nothing at all.
  4. The call is receipted like every other one, naming the rule that fired. Where Enforcer sits in front of a coding agent as a hook it can only advise, because a hook cannot change a model. Point an agent at the proxy instead, which is any agent on an API, and Enforcer rewrites the request itself, downgrade only.

Watch it decide.

the task you typed
running on
enforcer says

Forty-three models across four providers are priced in, so a mixed fleet is measured at each model's own rate rather than one blended guess. A wrong downgrade costs more in bad work than it saves in tokens, which is why it moves one step and says nothing when it is unsure.

An agent you cannot ground is not autonomy. It is exposure.
the case for deciding before the action, not after
What it takes to run this in production.

The demo proves the mechanism. Putting agents in front of real budgets and real customers needs the unglamorous parts too. Here is what that looks like.

Control

Stop, scoped how you need it

Halt one agent, one tool, one team, or the entire fleet. Automatic triggers on spend velocity and repeat loops, so the stop does not wait on a human noticing.

fleet stop · live above
Evidence

Receipts that survive an audit

Every verdict hash-chained to the one before it, so an edited record breaks the chain and shows it. Exportable for whoever asks to see it.

try the tamper button above
Speed

Caught by its rate, not its total

A session that fans out to dozens of subagents reaches four figures in one sitting. Every spend cap is a total, and a total only notices once the money is gone. This watches three rates instead: dollars a minute, new agents a minute, and errors an agent keeps retrying through.

$2 a minute, 8 new agents, 6 errors
Scale

Budgets per team, policy as code

Per-team and per-project budgets, rules kept in version control and reviewed like any other code, and single sign-on so the approver is a real named person.

roadmap
Run it on your own agents.

Everything above is a simulation. The real thing does the same job for your actual agents and runs entirely on your own machine, nothing leaves it. It is not built for one provider: Claude, ChatGPT, Gemini and Grok are all first-class, and anything that lets you set a base URL works the same way. Pick what you use and copy the line.

Where does this go? Into your computer's command line, not a chat window. On a Mac open Terminal, on Windows open PowerShell, then paste and press enter. You need Node.js installed first, it is free. The dashboard opens by itself.

The dashboard is yours alone, on your own machine. It shows nothing until one of your agents does something, then every decision appears on it live.