Every AI agent controlled by you
Every decision below is made by the sidecar, not a simulation. Real ECDSA P-256 signing on every call. Real hash-chained evidence. Real trust enforcement on models, databases and APIs.
Agents are being given production access faster than anyone can review it. This decides every call one of them makes, before it happens.
Dropping a table, deleting production data, moving money. Refused before the statement is sent, at every trust level including the highest.
Per model, per statement, per route. An agent that may read a customer cannot move that customer's money.
Agents hold no credentials. A compromised or manipulated agent has nothing to steal and nowhere to go.
One label covers every AI pod in the namespace. No SDK, no code change, no team to persuade.
A trust level is not a permission. It says how strongly the identity was established, and policy decides what that buys. Two agents with the same permissions and different levels are not the same risk.
| Model | Requires |
|---|
| Agent | Service account | Level |
|---|
Every record in the chain is signed with the matching private key, which never leaves this process. Anyone holding the key above can verify a receipt without asking us anything.
Every incident you can replay above used valid credentials. Authentication worked perfectly. Nothing was deciding whether the action should happen.
The sidecar holds the identity and leases the database password for one authorised statement. There is no long lived secret inside the agent process to exfiltrate.
The weights are digested and pinned. A substitution fails on the next request, before the credential is even read, for every caller.
Every statement is decided on its own merits. Reading a customer and moving their money are different questions.
Coverage is a property of the namespace, not of whether a team volunteered. Pods deployed long after you stop asking are enforced.
An agent with schema rights is one confused reasoning step away from an unrecoverable afternoon. DROP sits at the top of the ladder.
Every decision, refusals included, is hash chained and signed. A receipt verifies with a public key and nothing else.
What it does not do. It does not read prompts. An adversarial instruction inside a properly credentialled request passes through, because the question it answers is who may make which call on what terms.