Almavar by 2Prod / Solution brief 03
Evidence before expanded authority
Organizations give AI agents more room when they can see what the agents did. Almavar decides every action outside the model and keeps a record you own.
Research & operational assurance · 6 min read · October 2026
Figures: Almavar operating data, 30 June to 21 October 2026.
Autonomy needs a record
Organizations keep AI agents on a short leash for a simple reason: when something goes wrong, nobody can show what the agent did or on whose authority. Take the leader from Solution brief 01, who approved one card to set up an EU launch. A month later an auditor asks who created the EU launch project, under whose authority, and who approved it.
With Almavar the answer is one record:
One Almavar audit record for creating the EU launch project: asked by the requester, signed in; agent, the operations agent; action, create a ServiceNow project, which needs approval; ran as the requester’s own ServiceNow access; inputs redacted, with a tamper-evident fingerprint; decision, approved by the requester; result, project created. The chain of authority runs from the person to the agent, the action and the system. The record can’t be edited or deleted, and its export is tamper-evident.
Every action writes a record like this, with who asked, which agent acted, what it did and under whose identity, the decision and the approval, the result, and the chain of authority from person to system. Inputs are redacted and fingerprinted, so the record proves what ran without keeping sensitive content. Nobody can edit or delete a record, and the export to your security tools is tamper-evident. The record lives in your environment, where your own team reads it.
Why the gate says no
The record also shows what agents were stopped from doing. About 2 in every 100 actions were denied in Almavar’s operating data, and the reasons say a lot about how the controls behave:
Why actions were stopped, as a share of all 354 denials: the person hadn’t signed in or granted access yet, 43.8%; invalid request caught before it ran, 29.9%; connection problem, stopped safely, 20.9%; blocked by policy, 2.8%; not part of what the person asked for, 2.5%.
Few denials came from an agent reaching for something forbidden, because an agent only sees the actions it has been granted. The largest share were people who hadn’t yet signed in to a system, a fix that takes one sign-in. Most of the rest were malformed requests caught before anything ran, and connection problems where Almavar stopped instead of guessing.
More agents, never more authority
The evidence has to hold when one request becomes several. Ask the finance, legal and strategy agents to review a teaming partner’s staffing and price plan and file the documents first, and three specialists work on it in parallel.
A request to finance, legal and strategy agents to review a partner’s staffing and price plan and file the documents first. All three specialist runs carried the same person. Along the way: 2 uploads to Google Drive, each approved; 1 action blocked; 2 unreadable attachments reported as failed. The result was one combined read-out. In Almavar’s operating data, about 1 in 5 requests brought in specialist agents, at about 3 specialist runs per request, and 100% of specialist runs carried the requester’s identity.
Each specialist runs as the person who asked, through the same checks and into the same record. Specialists use their own granted tools, and the person’s authority never widens. Delegation is bounded in depth and size, so one request can’t fan out without limit.
Autonomy is earned, one action at a time
With a record of every action and a reason for every no, you can decide what an agent should do alone, one kind of action at a time. A desk counts approvals for each kind. After five in a row it offers to let the agent act, one decline sends it back to asking, and policy-controlled actions never count.
Trust is earned per kind of action. For “create Jira issue”, five approvals in a row lead the desk to offer: let it create Jira issues on its own, or keep asking. Until then the agent asks; after the offer is accepted it acts if pre-approved; a single decline sends it back to asking. Policy-controlled actions never count toward a streak.
The agent also checks its own work. Before its first change it lists what it will deliver, and a completion check holds it to that list. When a result falls short, or a change fails after approval, the person hears about it, and Almavar never quietly retries a failed change.
Measured gains, tested boundaries
The platform under these agents is still improving, and the gains are measured. On an internal benchmark of six real tasks, run three times each, one October 2026 release moved the results like this:
Internal benchmark of 6 real tasks, run 3 times each, before and after one release. Tasks completed correctly: 14 of 18 on 3 October 2026, 18 of 18 on 4 October 2026. Median time per task: 57.3 seconds before, 30.3 seconds after.
Calls stay quick with every check in place: a typical call into a business system returns in about 0.4 seconds. Behind the boundary sit 16,503 automated tests, 584 of them on authorization, isolation and failing safely. Among the things they prove:
- A denial holds even if the AI layer’s own safeguards are bypassed.
- An agent can’t use an action it wasn’t granted, even when the person could.
- Suspending a person stops their agents before the next action.
- Another organization’s users can’t reach your data.
- An advisory “allow” never overrides a firm deny.
Where these figures come from.
Figures come from Almavar’s operating deployment between 30 June and 21 October 2026, which 2Prod runs for its own company work.
Put a real workflow on the table.
Which systems matter, what should the agent do, who may approve it, and where must it run?