RotaGrant is live. Try agent governance on synthetic data, in your browser. See the live demo →

Skip to content

The platform

How it worksNine gates, in a fixed order
AuthorityBounded, expiring, signed for
EvidenceSequenced, sealed, checkable
ComplianceSeveral regimes at once
AssuranceWhere our own controls fail

Evaluating it

ArchitectureBuilt to be checked, not just run
Where it runsYour cloud, or airgapped
Security postureWhat can leave the network
SpecificationApache 2.0, and unbranded
PricingObserve and shadow are free

What it does

Checked before the action, recorded either way.

Nine gates run in a fixed order before anything consequential happens, and the record says what each one did — including the gates that never ran, and why they did not.

By region

European UnionAI Act and GDPR
United StatesSR 11-7 and NIST AI RMF
United KingdomSMCR, and the identifier gap
United Arab EmiratesDIFC Regulation 10, mapped
SingaporeFEAT principles, and the NRIC packs
Australia
IndiaServed by Rotavision
All regions

Mapped clause by clause

EU AI ActFourteen clauses, staged dates
GDPRIncluding the clause most tools skip
UK GDPRArticle 22 repealed, February 2026
DIFC Regulation 10Written for autonomous systems
SR 11-7Model risk, for models that act
NIST AI RMFVoluntary, and widely asked for
Regulatory mappingEvery clause, and whose job it is

Evidenced, not scored

DORAICT third-party risk, and the incident clock
ISO/IEC 42001No software certifies you
Canada AIDANot law; here is what is
MAS FEATYou define the fairness objective
UK frameworkDelegated to your regulator
All instrumentsMapped and evidenced, together

By sector

Financial services
Capital markets
Insurance
Healthcare
Life sciences
Energy and utilities
Telecommunications
Government
Software and AI-nativeNot regulated, and shipping fastest

Start here

OverviewThree lines, and the refusal is a value
QuickstartOne call before a consequential action
Turning on enforcementObserve, shadow, canary, enforce, one grant at a time

Reference

Documentation
Python SDK
TypeScript SDK
MCP server and proxy
HTTP API

Try it

The live demo
Open specification
Verify an artefact

What it takes

Your code cannot forget to check.

Three lines, and the decision happens before the block. A refusal raises rather than returning a value somebody has to remember to inspect, so an action that was not permitted cannot go ahead by omission.

Read

BlogArguments, mostly
GlossaryThe vocabulary, without jargon
Frameworks
Changelog

Check

Verify an artefactIn your browser, not ours
Status
How this differs
FAQ

What to read

Written to be disagreed with.

What the regulations actually say, where our own controls fail, and the engineering underneath — rather than whatever would rank for a search term.

Company

AboutWho governs the agents nobody owns
EuropeResidency is where it runs
BrandThe company and the product
ContactSales, security, or a question

Trust

Security
Trust centre
Enterprise
Services
Pricing
How it startsThe ladder, and what each rung costs

Who we are

Govern the action, not the model.

A division of Rota, Inc., San Francisco, with Rotalabs doing the research behind it.

Sign in See it live

See it live Search Sign in

Platform

The platform

How it works
Authority
Evidence
Compliance
Assurance

Evaluating it

Architecture
Where it runs
Security posture
Specification
Pricing

Solutions

By region

European Union
United States
United Kingdom
United Arab Emirates
Singapore
Australia
India
All regions

Mapped clause by clause

EU AI Act
GDPR
UK GDPR
DIFC Regulation 10
SR 11-7
NIST AI RMF
Regulatory mapping

Evidenced, not scored

DORA
ISO/IEC 42001
Canada AIDA
MAS FEAT
UK framework
All instruments

By sector

Financial services
Capital markets
Insurance
Healthcare
Life sciences
Energy and utilities
Telecommunications
Government
Software and AI-native

Developers

Start here

Overview
Quickstart
Turning on enforcement

Reference

Documentation
Python SDK
TypeScript SDK
MCP server and proxy
HTTP API

Try it

The live demo
Open specification
Verify an artefact

Resources

Read

Blog
Glossary
Frameworks
Changelog

Check

Verify an artefact
Status
How this differs
FAQ

Company

Company

About
Europe
Brand
Contact

Trust

Security
Trust centre
Enterprise
Services
Pricing
How it starts

Newsletter

That did not work.

The link may have expired, or been used already. Try subscribing again, or email us.

Read the blog Home

Agent governance, in your environment.

Elsewhere

Rotalabs our research entity
Rotavision for India

Platform

How it works
Authority
Evidence
Compliance
Assurance
Architecture
How this differs

Solutions

By region
Regulatory mapping
All instruments
Financial services
Insurance
Government
Healthcare

Proof

Live demo
Verify an artefact
Specification
Changelog
Status
FAQ
Glossary

Build

Search
Documentation
Developers
SDKs
MCP
API
Get started

Company

About
Security
Trust
Blog
Services
Pricing
Contact

© 2026 Rota, Inc. San Francisco, USA. Privacy Terms Copyright Brand

We would like to measure which pages get read. That needs one Google Analytics cookie. Say no and the site behaves identically — nothing here is gated on it. What it collects.