An AI agent that approves a payment or handles personal data carries the same obligations as the person who used to do that job. Solcis, a new company spun out of Australian GRC vendor 6clicks, has launched two products to enforce those obligations on each action an agent takes.
Solcis is led by 6clicks co-founders Anthony Stevens and Louis Strauss. It shares owners with 6clicks but operates as a separate business with its own team, platform and infrastructure.
The company says it found plenty of security tools for controlling AI agents, but nothing built for compliance. Open runtime enforcement engines such as NVIDIA OpenShell and Microsoft's Agent Governance Toolkit control what agents can access. Solcis says they do not know an organisation's obligations or prove they were met.
Solcis Compliance Studio is the control centre. Compliance teams use it to turn obligations into policies, the rules every agent action is checked against in realtime. Studio also manages where those policies are enforced.
Studio covers policy authoring and lifecycle management, drift detection, compliance reporting and agent discovery. It also recommends a small language model for each policy, drawn from models Solcis has benchmarked for compliance.
Policies can be enforced through OpenShell or Microsoft's toolkit, extending their security guardrails to compliance rules. Alternatively, organisations can use the Solcis Policy Engine, the company's own enforcement engine.
The Policy Engine sits directly in the path of agent actions. It connects through the Solcis SDK, or through the Solcis Gateway on model, tool and MCP endpoints. Every action receives an Allow, Deny or Escalate decision with a severity rating.
Solcis says decisions are reached in under 200 milliseconds. Deterministic checks apply fixed rules that return the same result every time, while inference-based checks use small language models to judge context and ambiguous cases.
Each decision produces a tamper-evident receipt recording the action, what executed, the outcome and who approved it. Receipts are held on a Universal Evidence Ledger that auditors and regulators can verify independently.
The receipts can also flow to a GRC platform, SIEM or data lake. For 6clicks customers, a connector brings obligations and controls into Compliance Studio and returns each receipt against the obligation and control it relates to.
Integrations also cover ServiceNow IRM and Archer. A shadow mode simulates enforcement without blocking anything before go-live, and a kill switch stops every agent at once.
"Most organisations know what the regulation says and what their systems do, but not how the two connect," said Anthony Stevens, CEO and co-founder of Solcis.
"The Solcis platform joins them up, from obligation to policy to enforcement to evidence. And for the organisations that need it most, keeping that chain on their own infrastructure isn't a preference, it's non-negotiable," Stevens said.
Solcis is built only to be self-hosted, including on sovereign cloud, on-premises and air-gapped infrastructure. The company says no policies or decision logs leave the customer's environment.
For Australian customers, Solcis maps controls to APRA CPS 230 and CPS 234, the Privacy Act and the SOCI Act. It also covers ASD's Information Security Manual and automated decision-making rules. Its listed local sovereign cloud options include Vault Cloud, AUCloud, Sliced Tech and Macquarie Government.
Both products are available now, directly and through partners. They will be listed on the Microsoft, AWS, Google Cloud, Oracle, NVIDIA and Red Hat marketplaces from November.
Compliance Studio is sold on subscription or perpetual licence, with no usage metering. The Policy Engine is released under the Functional Source License, so its code is open to audit.