Platform · For security and platform teams

Deterministic control plane for all your AI.

Policy, approvals and evidence in one console. Run it hosted, in your VPC, or on-prem in a container.

Open the console Talk to us about self-hosting

IT and security set policy once.
Developers change one line.
Platform deploys anywhere.
Approvers decide with a signature.

Why MACAW Platform.

One place to decide what your AI may do, and to prove what it did.

Deterministic by design
Every decision comes from policy, not a model’s judgment. The same call gets the same answer every time, with a signed record of why.
Plugs into what you run
Your identity provider in, your OpenTelemetry stack out. Agents, frameworks and MCP servers connect through thin adapters, with no rewrites.
One view for every team
Security writes policy, platform teams run it, developers see why a call was denied, and auditors pull the evidence. Same console, same facts.
Enterprise-ready
SSO, policies that inherit from company to team to person, human approvals and a tamper-evident audit trail. Hosted, in your VPC or on-prem.

Simple questions. Scattered answers.

You’ve answered these before, for people and services. Now answer them for AI, in one place.

QuestionTodayWith MACAW

WHOIAMlogsidentity toolsmanual correlationAgent Registry

WHATSIEMfiltercorrelateexportActivity Graph

WHENtimestampssystemsinstrumentcorrelateAudit Trail

WHYRBACIdPpolicyrule configsPolicy Store

HOWticketslogsrecreate manuallyApprovals

One system answers all five.

The console experience.

For the IT, product security and platform teams who run AI in production. Pick a part to see it.

MACAW Console: Activity Graph, graph and events

Point at or tap a number for what each part does.

Identity in. Evidence out.

Who is asking comes from the identity provider you trust. What happened goes to the tools you already watch. The control plane runs wherever you need it.

Identity in

Your identity provider says who is asking. Claims like role, department and groups become facts your policies decide on. Switch providers without touching code.

Okta
Microsoft Entra ID
Auth0
Google Workspace
Keycloak
Any OIDC provider

SAML and SCIM for console sign-in on Enterprise.

Identity Bridge

MACAW control plane

policies · agent IDs · audit events

We run the control plane. Start free in minutes.

Enforcement, prompts and tool arguments stay in your environment either way.

Evidence out

Every decision, allowed or denied, streams over OpenTelemetry to the tools your security team already watches. Set up in the console, with no code changes.