# Solcis Launches AI Agent Compliance Studio and Policy Engine

The self-hosted platform connects written controls to decisions before an agent acts, with deployment evidence still important to evaluate.

By Paras Madan | 2026-10-22


Solcis launched Compliance Studio and the Solcis Policy Engine on October 21, 2026. The self-hosted products are designed to check AI-agent actions against an organisation's controls before they execute, then record evidence of the decision. The practical question is how completely those checks cover an agent's real workflow.

The company is a [spin-out of 6clicks](https://www.6clicks.com/resources/blog/introducing-solcis). Its [launch announcement](https://solcis.ai/blog/introducing-solcis) positions the products alongside NVIDIA OpenShell and Microsoft's Agent Governance Toolkit, rather than as replacements for those security tools.

## What Solcis Compliance Studio does

Compliance Studio is where teams define and maintain policies. The Policy Engine evaluates actions against those controls, while Studio records decisions in an evidence ledger. Both run inside the customer's infrastructure, according to the [Solcis documentation](https://docs.solcis.ai/).

This separates two responsibilities that are easy to blur. Engineers connect the application to enforcement points. The people responsible for controls maintain the rules those enforcement points apply.

Consider an internal agent updating a customer record. Permission to call the database is only one question. Whether that particular update is appropriate, whether it needs approval and what evidence should be retained are separate questions. A policy layer is useful only if the application supplies the context needed to answer them.

## How the Policy Engine checks an action

Solcis says its engine combines fixed rules with model-based checks for cases that require contextual judgement. The result is Allow, Deny or Escalate. Integrations can sit in an application's action path through an SDK, or in front of model, tool and MCP endpoints through a gateway.

The company claims a complete check loop under 200 milliseconds. That is a vendor claim, not an independently established latency budget for every policy or deployment. A team should measure the checks it actually needs, including the slowest cases and human escalation paths.

**An enforcement decision and a correct decision are different things.** A perfectly functioning gate can still apply an incomplete rule. Evaluation needs to include actions that should be refused, legitimate actions that should pass and ambiguous cases that should reach a person.

## Evidence is useful, but coverage comes first

The [product site](https://solcis.ai/) describes cryptographic decision records containing information such as the action, outcome and approval. Records can be sent to an evidence ledger, governance platform, SIEM or data lake.

That can help a team reconstruct what happened without relying only on a conversational transcript. It does not, by itself, prove that the original rule was appropriate or that every possible execution path passed through the gate.

This is the implementation detail worth examining first. If an agent can reach a tool through an unmonitored route, a complete-looking ledger may describe only the actions the enforcement layer saw. Teams need to establish the boundary before treating the records as a complete account of agent behaviour.

## Availability, licensing and what remains unclear

Solcis says both products are available directly and through partners. Cloud marketplace distribution is planned for November 2026, not already available through those channels. Compliance Studio offers subscription or perpetual licensing without usage metering, but the launch announcement does not publish a price.

The [Policy Engine uses the Functional Source License](https://solcis.ai/company). Solcis describes this as Fair Source and open to inspection. It should not be confused with a permissive open-source licence.

The public documentation still marks its detailed Evaluate and Deploy sections as coming soon. Those sections are intended to cover matters including security, the threat model, deployment boundaries and installation. The announcement establishes a product launch; it does not remove the need to inspect those details with the vendor before deployment.

For teams moving from agent demonstrations to operational systems, the important next step is testable control coverage. A policy is only as useful as the action path that consistently enforces it.

I’m Paras. I work at the intersection of AI, engineering and distribution.

I help teams explain complex enterprise AI products through clear technical and executive storytelling, without turning implementation details into marketing claims.

[Book a 30-minute call](https://cal.com/paras-madan/30min).