Full speed, inline policy

Hold out-of-policy actions before they run — on the path agents already use.

Not a separate review step. Not SIEM triage hours later.

Your SOC gets the decision, the reason, and an exportable record — without slowing the fleet.

Three gates your security team defines

Rules you own and audit — not abstract AI safety labels.

Each gate maps to how your org actually runs agents in production.

Data trust

Untrusted content cannot reach payments, email, or other high-risk actions.

Taint tracking (provenance labels) stays scoped — downstream tools only see what policy allows.

Tool order

Block scrape-then-shell and read-then-publish sequences your team worries about.

Order enforcement complements per-tool mandates.

Cross-agent bus

Monitor agent-to-agent messaging for exfil patterns.

Workloads with sensitive data cannot route through internet-facing agents without explicit approval — exfil patterns stop at the bus.

Example policy hold

SCOPE
GitHub issue injection — install denied
research-agent → read issue → run shell install
What happened: Issue text contained instructions to install an unapproved package.
Why held: Injection pattern matched. Package not on signed manifest.
Outcome: No shell command ran. Session remains auditable.
INJECTION DATA TRUST OUT OF ORDER

Decision records are built for CISO and SOC review — plain English, same shape as your command center. What was attempted, which gate held, and the audit outcome. No tool codes in the headline.

More held decisions on the policy decisions page — mandate scope, memory tiers, injection, and cross-agent containment.

All policy decisions

Investigate any session in minutes

Open a run: timeline, action flow, and tamper-evident audit record.

See what executed — and what policy stopped before it could.

Session run_bus9f3e — Investigate

Storyline: Exfil pattern contained at bus. No external publish.

data-agent read customer segment export (in-scope data)
data-agent sent message to agent bus with outbound payload
agent bus routed toward internet-facing agent
Stopped at bus — cross-agent exfil pattern. Message not delivered.
Hash chain: VALID
block_3e8a… → block_5b2c… → block_7d1f…
Exportable JSON for auditors and SIEM

Contain, then prove

Hash-chained decision log — each hop from human to agent to tool is recorded. Compliance and audit teams export JSON, not screenshots assembled after the fact.

SIEM export

Splunk, Datadog, and structured JSON export for existing SOC workflows.

Sub-ms hot path

Inline checks on the enforcement path.

Full pipeline with optional LLM judge for edge cases.

Seven layers — each decision corroborated

Confidence from independent signals, not one classifier score.

Structural, statistical, and semantic layers stack so your team can review why policy held.

Layers 1–3 ship in the open source SDK.

1
Structural patterns
Known injection signatures — fast structural match
2
Statistical anomaly
Argument entropy and length per tool
3
Control flow
Unauthorized tool sequences
4
Embedding similarity
Distance from known-good patterns
5
Out-of-distribution
Autoencoder reconstruction error
6
Execution trace
Structural anomalies across the pipeline
7
Reasoning judge
Intent alignment for ambiguous cases

Most stacks stop at one model score. Agentic Glass composes independent methods — so held decisions carry corroborating signals your reviewers can trust.

Eval F1 on synthetic corpus; hot path latency on benchmark harness. Contact us for methodology and benchmark details.

Enforcement sits on the same fabric as who the agent is and what it may retrieve. Explore held decisions or talk with us about deployment on your stack.