Can the AI agent be prevented from acting without human approval?

It already is — approval is mandatory on every write by default and there's no autonomous mode to enable, so the gate can't be configured away.

Can we keep LLM traffic on our own infrastructure?

Yes — Bring Your Own Model routes every agent's LLM calls to your own OpenAI-compatible endpoint. Those tokens are zero-rated in credits; a platform-infrastructure fee still applies for the compute and orchestration of running each task.

Is there an audit trail of what the agent did?

Yes — actions are recorded per organization, covering what was proposed, who approved it and what applied, so a change can be traced after the fact.

Can our internal systems drive the agent programmatically?

Yes, in both directions — per-organization API keys and an MCP endpoint let your systems and agents drive tasks, and custom MCP servers let the agent reach your internal tools and data.

Do you have SOC 2 or ISO certification?

Not currently published. If formal vendor certification is a hard requirement for your procurement process, raise it before committing — the governance controls (mandatory approval, audit trail, role separation, workspace isolation, BYOM) are real and independently verifiable regardless.

For

Enterprise AI ad ops — approval gates, audit trail, your own model endpoint

TL;DR

At enterprise scale the question isn't whether an AI agent can optimize a campaign — it's whether you can prove what it did, restrict who can let it act, and keep model traffic on infrastructure you control. Agent Planners is built with those as defaults rather than add-ons: approval is mandatory and cannot be switched off, every action is recorded, roles separate analysis from authority, and Bring Your Own Model routes LLM calls to your own endpoint.

Governance that isn't a toggle

Mandatory approval on every write — there is no autonomous mode to enable, so no configuration drift can quietly remove the gate.
Stale-state revalidation — an account is re-read immediately before a change applies, so an approved-but-aged recommendation can't fire against a since-changed account.
Audit trail — a durable record of what was proposed, who approved it and what applied.
Role separation — Members run analysis, Editors approve writes and authorize integrations, Admins control membership and billing.

Bring your own model

Every agent's LLM calls can route to your own OpenAI-compatible endpoint instead of the built-in gateway — relevant when model traffic has to stay on infrastructure you control for data-residency or procurement reasons. LLM tokens on your endpoint are zero-rated in credits; a platform-infrastructure fee still applies for the compute, database and streaming work of running the task.

BYOM is available on paid plans. The setup is on the BYOM page; the cost trade-off is worked through in is BYOM worth it.

Programmatic access, both directions

Direction	What it enables
Outbound — your systems call us	Per-organization API keys over a REST API, plus an MCP endpoint so your own agents (Claude, ChatGPT, internal tooling) can drive tasks
Inbound — we call your systems	Custom MCP servers expose your internal tools and proprietary data to the agent, alongside 250+ SaaS apps via Composio

Workspace isolation

Each organization is a fully isolated workspace — its own connected accounts, integrations, account memory, skills, audit log and billing. Nothing is shared across organizations unless a skill is deliberately shared, which makes brand-, region- or business-unit-level separation structural rather than procedural.

Where the honest limits are

Worth naming directly, because it should factor into an enterprise evaluation: this is a self-serve product with usage-based plans (Scale at $500/month, Agency at $1,000/month) rather than a sales-led enterprise contract, and we don't currently publish SOC 2 or ISO certification. Teams with a formal vendor-certification requirement should raise it before committing, not after — and the governance controls above are real regardless of what a certification page would say.

Frequently asked questions

Can the AI agent be prevented from acting without human approval?: It already is — approval is mandatory on every write by default and there's no autonomous mode to enable, so the gate can't be configured away.
Can we keep LLM traffic on our own infrastructure?: Yes — Bring Your Own Model routes every agent's LLM calls to your own OpenAI-compatible endpoint. Those tokens are zero-rated in credits; a platform-infrastructure fee still applies for the compute and orchestration of running each task.
Is there an audit trail of what the agent did?: Yes — actions are recorded per organization, covering what was proposed, who approved it and what applied, so a change can be traced after the fact.
Can our internal systems drive the agent programmatically?: Yes, in both directions — per-organization API keys and an MCP endpoint let your systems and agents drive tasks, and custom MCP servers let the agent reach your internal tools and data.
Do you have SOC 2 or ISO certification?: Not currently published. If formal vendor certification is a hard requirement for your procurement process, raise it before committing — the governance controls (mandatory approval, audit trail, role separation, workspace isolation, BYOM) are real and independently verifiable regardless.