Each agent action risk-scored and priced before it runs, logged after.
An agent pilot rarely dies on capability any more; it dies at the desk that has to buy it.
Procurement asks what it costs at forty people and which region processes the content. A platform lead at a European firm of 40 to 250 staff cannot carry a system that answers neither in writing.
- StockholmRegistered in
- FerruleEntity
- [email protected]Contact
[Ferrule]
01Alona KarasovaCEO
02Tobias EkelundCTO
03Priya RamanCOO
- 01
Alona Karasova CEO
Ran platform procurement at a Nordic insurer and killed four agent pilots herself, every one of them for a missing rate card rather than a missing feature.
- 02
Tobias Ekelund CTO
Built the API gateway at a payouts platform where every call had to carry a price and a trace id before it left the process, and learned that metering after the fact never reconciles.
- 03
Priya Raman COO
Spent six years writing vendor security questionnaires from the buyer's side and stopped believing any answer that could not be checked against a document with a date on it.
- 02
Ferrule is the half of an agent stack that acts: a gateway every tool call passes through, which authorizes, prices, executes and logs it.
A risk classifier scores the request and the agent's ceilings are checked. The call is quoted on the public rate card, then run with the customer's own grant.
- 03
Ferrule's risk classifier reads what an action's parameters say, which no ceiling or schema rule can judge.
A routine action and a harmful one often call the same endpoint with the same parameter shape. Rules settle who may act and at what price; the classifier scores every request's tool, operation, parameters and calling agent for risk and intent. Anomaly detection flags an agent that calls a new tool or draws more refusals than its baseline.
- 04
A named person at each customer sets which agents may act, their spend ceilings and the risk ceiling, and no model can raise one.
Above a spend ceiling an action is refused; above the risk ceiling it is refused or held for that person. Their decision tunes only that tenant's risk threshold. What Ferrule owns is a labeled example set we write for each schema in the published catalog.
- 05
Ferrule's infrastructure bill follows actions and retention, not headcount.
Every action costs a classifier call, a gateway pass that adds under 40ms at the 95th percentile, and a log entry. Payloads are kept 30 days, the log 400 and metering records seven years, so in a customer's first year only payloads expire. A refused action costs all three and bills nothing.
- 06
Ferrule's terms name the regions that process content instead of leaving residency to a sales call.
The gateway runs on cloud infrastructure in Stockholm, with credentials, metering records and the action log in object storage there. Both models run on Azure in Sweden Central: the classifier on Azure OpenAI under zero data retention, anomaly detection on Azure Machine Learning. No action payload leaves the EU.
- 07
During 2027 Ferrule's own classifier, on cloud GPU instances in Stockholm, does most risk scoring.
It is an open-weight encoder under a billion parameters, tuned in Azure Machine Learning on catalog examples, never a customer payload. It scores faster and cheaper than a hosted call. The gateway switches to reserved capacity once customers pass two million actions a month. Ferrule AB dates from May 2025, and its three founders have taken no outside capital.