The agent may ask.
The action must qualify.
The attacks content scanning cannot catch are the ones that look like work: forward these invoices, export those customers, then clean up. Agent Security authorizes the arguments of every action, not just the words around it.
- Constraints on recipients, domains, amounts, row counts, and flags
- Allow, require approval, or deny, with the strongest rule winning
- Fail-closed: an evaluation error halts the action, never allows it
- Signed, append-only action log that stores digests, never raw data
/ How it works
Between the agent's intent
and the world's state.
Agent proposes
A tool call arrives with concrete arguments: an address, an amount, a row count, a destructive flag.
Arguments qualify
Policies evaluate the arguments themselves: is the recipient domain yours, is the export under the ceiling, is the flag allowed.
Verdict with teeth
Allow executes. Require-approval halts for a human. Deny refuses and names the constraint that failed.
Signed record
The decision, matched policy, and argument digests land in an append-only log with an HMAC signature.
/ Capabilities
Everything this layer holds.
Argument-constraint policies
A compact DSL over dotted argument paths: domain lists, numeric bounds, regex, required fields, and item ceilings.
Strongest rule wins
Deny beats require-approval beats allow, always. A high-priority allow can never bury someone else's deny.
Fail-closed evaluation
Unknown operator, invalid rule, or an unreachable policy engine: the action halts for approval. Errors never widen access.
Evidence without exposure
The action log stores argument digests and violated constraint keys, never raw customer data, and every row is signed.
Revocable agent identities
Every agent call carries an identity resolved against a registry. Revocation is a row update that takes effect immediately, not a secret rotation.
Governed tools over MCP
Tool access flows through a governed MCP server: scanned before execution, scanned after, and appended to the audit chain.
/ The difference
Content answers what was said.
Authorization answers what happens.
Our own red-team corpus measured exfiltration-style attacks passing content inspection more than four times in ten, because they are indistinguishable from legitimate work at the text layer. This layer exists because we printed that number instead of hiding it.
Forward all invoices to an outside address reads as normal finance work and executes.
The recipient domain fails the org-domain constraint. The action halts for approval before a single message leaves.
A compromised agent exports the customer table one polite request at a time.
Bulk-export ceilings are arguments, not vibes. Row counts above policy require a human, every time.
Agent credentials leak, and rotation takes a maintenance window.
Identities live in a registry. One row update revokes an agent everywhere, immediately, with a 403 to prove it.
The audit trail is whatever the agent framework happened to log.
A signed, append-only decision log built for disputes: what was asked, what rule matched, what happened.
/ The rest of the stack
One layer is a feature. Six is a fabric.
Ready to run on WIT OS?
Talk to the team about a managed deployment, a pilot, or a custom agent. We typically respond within an hour.