AI agent platform Melaya enforces platform-level approval gates and full action logging; discloses no insurance or outcome-linked pricing

Melaya, a platform for building and running teams of AI agents across business tools, browsers and Android phones, pauses any action that posts, sends or pays pending a human's sign-off and records every pipeline run, tool call and model invocation, according to the company's own site.

"Every action that posts, sends, or pays can pause for your approval, enforced by the platform rather than requested in a prompt," the company states. It adds: "Before anything consequential happens, a person approves it, and every run can be replayed step by step." Permission is granted in pieces rather than all at once: "8 OAuth scopes you grant one at a time. The tool list is filtered to what you approved."

Melaya also discloses a third-party security review: "Independently security-audited by TAC Security — ESOF AppSec, App Defense Alliance CASA, aligned to the OWASP Application Security Verification Standard (ASVS)." Its top, Citadel-tier plan adds an unspecified service-level agreement: "Citadel adds private deployment, dedicated solutions engineer for tools or role creation, venues integration, dedicated workflows, and SLA."

AI Dispatch's trust-gap rubric, scored against Melaya's published material Oct. 14, credits the approval gates and logging described above: runtime governance and audit trail each score 2 of 3, short of a published, customer-reviewable retention or tamper-evidence guarantee. Compliance scores 1 of 3 — a security audit exists but names no certification against a published standard. Outcome settlement and insurance-indemnity each score 0 of 3: Melaya's five subscription tiers run from Sandbox at $0 a month to Citadel at $490 a month and up, billed by usage limit rather than result, and a full-text search of Melaya's homepage, a 14,848-character capture retrieved Oct. 6, found no mention of "insurance," "indemnif," "liabilit," "certif," "arbitrat," "warrant," "SOC 2," "ISO 27001," "outcome" or "escrow."