Agent Security Control Plane

Agent boundary evaluation with ALLOW, DENY, and STEP_UP

Shield evaluates normalized traces from sandboxed adapters. It does not execute untrusted agent code. Six deterministic suites cover tool overreach, secret access, prompt injection, network egress, process escape, and authority drift. Every eval returns a SHA-256 receipt for audit.

• POST /v1/boundary-eval with subject, events, and optional policy_id from enterprise packs.
• GET /v1/boundary-eval/policies lists Cursor, MCP, CI runner, skills marketplace, and support bot packs.
• POST /v1/agent-control/decide returns ALLOW, DENY, or STEP_UP for a single action.
• POST /v1/boundary-eval/verify validates receipt integrity for GRC evidence packets.

Evaluate a trace Control plane overview

Pair with agent approval scorecard

Before production rollout, run POST /v1/agent-security/scorecard to combine static skill analysis with boundary traces in one approved, conditional, or denied gate. Org assessment and release hooks can include the same boundary payload.