Canonify — The governed runtime for AI agents

The problem

AI agents in production are terrifying

The demo works. Production is a different story.

No guardrails

An agent with a database connection can do anything. Delete data. Skip validation. Call the wrong action twice. You're one hallucination away from a production incident.

No audit trail

When things go wrong — and they will — there's no record of what the agent did, when, or why. Good luck explaining that to compliance.

No constraints

Most agent frameworks give AI unlimited access. That forces you into read-only mode, or a human-in-the-loop for every action — killing the entire point of automation.

The solution

Declare the rules. Let agents play.

Canonify is a governed runtime where you explicitly declare every action your business allows — then AI agents operate within those bounds.

Agents (AI + humans)

Invoke declared actions. Same governance for both.

Runtime (Canonify)

Enforces governance, audit, policies, idempotency.

Canon (the bundle)

Declarative, diffable, version-controlled system spec.

Business logic in JSON,
not code

A Canon is a complete, machine-readable specification of your business domain. Entities, state machines, actions with guards, access policies — all declared, all version-controlled, all audited at runtime.

AI can read and understand the entire domain
AI can generate new Canons from natural language
Agents can only invoke declared actions
Every invocation has an audit event ID
Guards enforce business rules automatically

canon/actions/deal.json

// Win a deal — with governance built in
{
  "name": "deal.mark_won",
  "handler": {
    "steps": [
      { "op": "read", "object": "deal" },

      // Guard: start_date required
      { "op": "assert",
        "when": { "present": true,
                 "ref": "$input.start_date" },
        "else": { "code": "VALIDATION" } },

      // Idempotent: only create if missing
      { "op": "read_optional",
        "object": "customer" },
      { "op": "insert",
        "object": "customer",
        "when": { "absent": true } }
    ]
  },
  "transition": {
    "from": ["contract_sent"],
    "to": "won"
  }
}

Capabilities

Everything agents need.
Nothing they don't.

Governed execution

Agents can only invoke declared actions. Guards enforce business rules. State machines prevent invalid transitions. No free-form database access.

Full audit trail

Every action — human or AI — gets an audit event with timestamp, principal, input, and outcome. Complete traceability from day one.

Declarative bundles

Your entire system is a JSON bundle — version-controlled, diffable, round-trippable. Export it, edit it, re-apply it. Git is your source of truth.

Built-in idempotency

Actions declare their idempotency mode. Agents can safely retry without creating duplicates or corrupting state. Production-grade by default.

RBAC policies

Fine-grained access control. Users, agents, and service accounts get exactly the permissions they need. Column-level, row-filtered, role-scoped.

Views & Forms

Declare UI specifications — tables, kanban boards, dashboards, public forms — alongside your data model. Staff tools without frontend code.

Comparison

Not another tool builder

Canonify solves a different problem than existing platforms.

      
        
            
            LangChain / CrewAI
            Retool / Appsmith
            HubSpot / Salesforce
            Canonify
          

        
            Agents are first-class
            Yes
            No
            Bolted on
            Yes
          

            Governed action surface
            No
            No
            Limited
            Yes
          

            Built-in audit trail
            No
            No
            Yes
            Yes
          

            Declarative system spec
            No
            No
            No
            Yes
          

            AI can generate the system
            No
            No
            No
            Yes
          

            Zero backend code
            No
            No
            Config, not zero
            Yes
          

            Version-controlled bundles
            No
            No
            No
            Yes
          

      
    

	LangChain / CrewAI	Retool / Appsmith	HubSpot / Salesforce	Canonify
Agents are first-class	Yes	No	Bolted on	Yes
Governed action surface	No	No	Limited	Yes
Built-in audit trail	No	No	Yes	Yes
Declarative system spec	No	No	No	Yes
AI can generate the system	No	No	No	Yes
Zero backend code	No	No	Config, not zero	Yes
Version-controlled bundles	No	No	No	Yes

Use cases

Built for the teams that
need governance most

Platform teams

AI-powered internal operations

Let agents handle customer success, procurement, onboarding, and support workflows — with the guardrails your compliance team requires. Every action audited, every transition governed.

System integrators

Ship custom systems in days

Replace months-long custom software projects with a Canon bundle. CRM, helpdesk, order management — declared in JSON, deployed in minutes. Iterate with the client in real-time.

SaaS builders

Embed governed workflows

Give your customers AI-driven operational workflows as a feature. Canonify provides the governed runtime — you provide the domain expertise and the Canon bundle.

Regulated industries

EU AI Act-ready from day one

Full traceability, human oversight, and constrained autonomy. Every agent action logged with principal, timestamp, input, and outcome. The audit trail your regulator asks for — built in, not bolted on.

The governed runtime for AI agents