Harp Technology and CocoAI partner to advance governed AI in regulated industries
Harp Technology and CocoAI have entered a formal partnership to help regulated organisations deploy AI agents with clear accountability, human oversight and auditable decisions.
Harp provides the operational intelligence platform for deploying, coordinating and managing AI-powered work. Coco governs what those agents do at runtime, against the organisation's own policies. Harp runs the work. Coco decides what the work is allowed to do, and keeps the evidence.
The problem in regulated work
In a regulated workflow, an agent's action carries the same weight as a person's. A payment released or a customer record changed has to stand up to an auditor and to the organisation's own risk team.
Organisations need control over what an agent does and evidence of why each action went ahead. They also need a clear point where a person steps in once risk crosses a threshold. A system prompt asks the model to behave; it does not stop the model. A log records what happened; it does not decide whether it should.
How Coco governs an agent
Coco sits between the model and its real-word action (tools). The model proposes an action, and Coco decides before the action runs, in code the model does not control.
Control
Deterministic rules decide first. Each rule comes from the organisation's own policy with our templates and runs against facts from its systems of record rather than anything the model says. The same call gets the same verdict every time. A classifier then judges what rules do not reach, such as an instruction planted in an email, and only ever tightens a verdict. When the engine has no answer, it denies.
Intervention
Every action ends in one of four verdicts: Auto-Execute, Observe, Escalate, or Deny with the reason. A payment above the auto release limit, for example, waits for a person to approve it, and the agent resumes once they decide.
Evidence
Every decision leaves a hash-chained receipt, and every rule traces back to the policy clause it came from. An auditor replays any rule decision and gets the same verdict.
Policy from the organisation's own documents
Coco builds all of this from documents the organization already holds. Its document processing reads policies, standards and procedures with their structure intact: sections, tables split across pages, figures and scanned pages. It returns AI-ready context where every value carries its page and the wording it came from, and compiles the same documents into policy contracts. Anything missing or conflicting goes to a person instead of an agent. A contract runs in testing first, where Coco records what it would decide without enforcing anything, and goes live when the organization promotes it.
How Coco fits Harp
Harp deploys, coordinates and manages the agents. Coco runs as a container inside Harp's own environment and checks each action through the Coco SDK, either as middleware in the agent runtime or through an HTTP gate. It speaks the standard OpenAI chat format, the same interface Harp's private AI inference exposes, so Harp and its clients decide where the models behind Coco run.
The work begins with documents. Harp's first client workflow uses Coco to turn source documents into structured, cited context for AI-ready. From there, Harp and Coco will bring runtime governance to Harp agents.
Coco never trains on client documents. Harp remains the system of record and the platform its clients see.
What the guardrails stop
We measure each layer of the check on public benchmarks, replaying tool calls through Coco and scoring every decision.
- On a corpus of 73,356 payment transfer calls built from 4,371 human written attacks, Coco's rules stopped every transfer the policy forbade and held none it permitted.
- On AgentDojo, a public benchmark of 588 attacks planted in emails, files, web pages and payment notes, rules and classifier together prevented 585. Over the same run, 18 of 97 legitimate tasks went to a person for review.
- A rule decision takes 0.27 ms at the median.
Full method and reproduction steps are available on request.
From our team
“An agent earns real work only when its decisions trace back to the organisation's own documents. Coco turns those documents into the context an agent reads and the policy it runs under, and records every decision against both. Harp puts agents into client workflows, and this partnership brings governance into those workflows from the first page.”
About Harp Technology
Harp Technology provides the operational intelligence platform for securely deploying, coordinating and managing AI-powered work. Its managed private AI inference runs models on client infrastructure across Australia and the United States. harptechnology.com.au
