For your team
Deploy AI you can defend to an auditor.
Autonomy is a risk unless it's governed and provable. Tokoaido makes trust earned, actions attributable, and controls demonstrable, so you can say yes to AI without losing control.
How Tokoaido helps
What changes.
Agents you build or connect start advisory, are promoted only by a measured track record, and are demoted when reliability drops.
Every consequential action is written to a single audit log with actor, target, risk and reason. Viewable in the product; export on request.
Platform controls mapped to the EU AI Act, NIST AI RMF, SOC 2 criteria and GDPR. A self-assessment, not a certification: we hold none today.
OIDC single sign-on, RBAC, tenant isolation, and a hard safety boundary.
Sound familiar?
The work nobody signed up for.
If you have said one of these this month, the rest of this page is for you.
The board asked whether our AI agents are under control. I could list them. I could not prove it.
An agent with an API key and no owner is the incident I lose sleep over.
Our audit evidence for AI is a folder of screenshots.
Legal wants to know which models see personal data. Nobody can answer in one place.
Ransomware sat in a peer's OT network for weeks. I need to know exactly what our agents can reach.
Use cases
What you would use it for, first.
Each one starts from a problem you can name, and ends with something a person can see has changed. Live means it runs in the product today; pilot means we build it with you.
- 01
Every agent has an owner and an off switch
Live todayTodayAgents are switched on by projects and forgotten by them.
With the platformThe control tower lists every agent with its owner, its autonomy level and what it has done, and can pause or stop any of them at once.
What changesWhen someone asks what an agent did and who owns it, the answer is one screen away.
- 02
Authority earned on a record, removed on a bad one
Live todayTodayAgent permissions are set once at launch and never revisited.
With the platformAgents you build or connect start advisory. Authority is raised only on a measured record of confirmed findings and approved, effective actions, and lowered automatically when reliability drops.
What changesAutonomy follows evidence, and high-risk actions wait for a person at any level.
- 03
Personal data kept away from external models
Live todayTodayNobody can say which prompts carried personal data to which model.
With the platformRecords carry a data class. PHI and payment data are never sent to an external model at any setting, and other personal data is refused by default, with a deterministic fallback.
What changesThe DPO gets a rule enforced in code, not a policy document.
- 04
An evidence pack for your AI review
Built in a pilotTodayAssembling evidence for an AI Act or internal AI review starts from scratch every time.
With the platformThe platform maps its controls to EU AI Act articles and NIST AI RMF functions as a self-assessment. In a pilot we build the evidence pack your reviewers need from the audit log and the control mapping.
What changesYour review starts from a mapping and a record, not a blank template.
Business value
Where the return comes from.
The levers, and the range other organizations have published for each. Ranges are typical of the category, not a promise and not our customers' results.
Cost of a breach
$4.99M averageThe global average in IBM's 2026 study. IBM sells security products.
IBM & Ponemon Institute, Cost of a Data Breach Report 2026 (2026)Attacked AI without access control
92%Most organizations whose AI was attacked had not controlled access to it. Owners, levels and an off switch are that control.
IBM & Ponemon Institute (via Cybersecurity Dive), Cost of a Data Breach Report 2026 (2026)OT ransomware dwell time
42 daysAverage time ransomware sat in industrial networks in 2025, per an OT security vendor. Agents here cannot address the safety system or write to a PLC directly.
Dragos, Dragos 2026 OT Cybersecurity Year in Review (2026)High-risk AI obligations
from 2 Dec 2027Deferred, not cancelled. The time to put records and oversight in place is before the date.
K&L Gates (Cyber Law Watch), EU Digital Omnibus on AI Enters Into Force (2026)Run your numbers
Evidence gathering you stop doing by hand.
Every input is yours to change, and the arithmetic is shown in full. Nothing is hidden in a multiplier.
6 × 160 × €85 × 40% = €32,640
An estimate on the numbers above, not a measurement and not a customer result. In an Operations X-Ray we replace the assumptions with figures measured on your own systems.
Before and after
The same week, run differently.
Agents run with keys and no owners.
Every agent has an owner, a level and an off switch.
Autonomy is a launch setting.
Autonomy is earned on a record and removed on a bad one.
Nobody knows which model saw personal data.
PHI and payment data never reach an external model, by rule.
AI audit evidence is screenshots.
Evidence starts from the audit log and a control mapping.
In practice · Example scenario
Defend an agent rollout
For any approved action, show the reason, the approver, the risk and the control it maps to, without a fire drill.
Operations X-Ray
Bring us your security review.
We walk your team through the controls, the model gate, the agent levels and the audit log, and answer the hard questions.