Agent security
Agent Guardrails
Available now
Enforce what an agent may touch outside the model, in a place a prompt cannot argue with.
Shipping today. Ask for access and we will get you a build.
What it does
Tool scoping
An explicit allowlist of tools per agent role. An agent that never needs to write to the database is not holding a credential that could.
Egress control
Where an agent may send data, enforced at the network boundary. Exfiltration through a legitimate-looking tool call stops being a single-prompt problem.
Credential brokering
Short-lived, task-scoped credentials issued by a broker at call time and never placed in the prompt or the context window.
Injection containment
Retrieved documents, tool output, and web content are carried as data with provenance attached, so instructions found inside them are never promoted to commands.
Action audit
Every tool call recorded with the agent, the task, the credential used, and the result — the record you need when something goes wrong.
Enforced outside the model
Guardrails a prompt cannot talk its way past.
- Tool access
- Allowlist per role
- Credentials
- Short-lived, task-scoped
- Network egress
- Destination allowlist
- Untrusted content
- Marked as data
- Every action
- Logged and attributable
How it goes in
Each step is a checkpoint you sign off before the next begins.
- 01
Inventory
List what each agent can currently reach — tools, credentials, data stores, and network destinations. This is usually the surprising part.
- 02
Define
Write the boundary per agent role: the smallest set of tools and destinations that still lets the job get done.
- 03
Enforce
Put the broker in the call path so the boundary is applied at execution, not requested in a system prompt.
- 04
Review
Watch the action log for denied calls and near-misses, and tighten or widen the boundary against real traffic.
Works alongside
Nothing here needs the rest of the line to be useful — but they are built to fit together.