Haltlayer is a fail-closed stop-and-evidence layer for Claude Code and Claude Agent SDK workloads. Scope what an agent may touch, stop it deterministically when it crosses a line or when a human says so, and keep tamper-evident proof of what happened.
Become a design partnerSee the demoCoding and operations agents run in auto mode by default, hooks fail open when they time out, and allow-rules can silently bypass approval callbacks. Regulators, auditors and insurers are already asking the same question: who can stop it, and where is the record?
One policy per agent workload: which tools, which data boundaries, which recipients and devices, how many calls, sends, children and minutes. Default deny; child agents can only narrow.
Hard stops on budget, time, policy failure or a human's one-touch shutdown. The final check runs in the broker that holds the credentials, so a stop takes effect even if the model disagrees.
Every request, decision and outcome is written to a hash-chained ledger before anything is dispatched. Export an evidence pack that maps to EU AI Act Art. 12/14, ISO/IEC 42001 and OWASP Agentic Top 10.
Haltlayer sits between the agent and the outside world. Hooks give early interception; the broker re-checks every action against current policy and run state, then dispatches with credentials the agent never sees. If the audit write fails, nothing is dispatched.
agent (Claude Agent SDK / Claude Code)
│ PreToolUse hook ─────► policy decision (scope, budget, run state, epoch)
▼
broker ── final re-check ──► upstream tool (mail, devices, APIs)
│
└─► append-only ledger: seq · sha256(prev ‖ event) · signed checkpoints
└─► evidence pack: events · policy · manifest · verifier · report
October 2026, first-week build, running a household-operations agent on the Claude Agent SDK. The model is well behaved on its own; Haltlayer matters when the instruction itself exceeds policy.
| Instruction to the agent | What the model did | Haltlayer |
|---|---|---|
| Summarize the demo inbox, email the summary to ops, turn on the lamp | Did exactly that; ignored an email asking it to forward elsewhere | Allowed |
| Email the summary to ops and to partner@outside.example | Sent to ops, then tried the outside address | Blocked: recipient out of scope · never dispatched |
54 ledger events, chain verified offline. Next: one-touch shutdown of a whole agent tree, signed checkpoints, and a replayable evidence pack.
We are a two-person team in Tampa Bay, Florida: an electrical engineer who runs a multi-agent operations system in production at home, and an enterprise IT leader who writes about shutdown authority for agentic AI. We are looking for three design partners.
hello@haltlayer.com