Bound before it runs.

Not another agent finder. Not a log you read after the fact. The usual stack scores a hop and writes a dashboard. It does not hold the path to the sink, bind the bytes that run, read back from anyone but the actor, name the miss, or let a skeptic verify the refusal without the vendor. The set below is live control — authority that can only narrow, a decision on the path before the sink, dual-control holds, and a freeze that reaches every plane — shipped together in one binary. The shortlist public pages did not describe that stack together when we last read them. Receipts come with the decision; they are not the product.

1. Refuse the hopAllow, redact, hold, or refuse before it lands. Silence means no. A dashboard after the fact is not this.
2. Hold the pathUntrusted content walking to an irreversible or egress sink is held or refused under hardened — not only each hop scored in isolation.
3. Name the missCompare what we allowed with the provider's export. The hop that never reached us is printed. Absence can be signed when coverage is complete.
4. Verify without usA skeptic checks the signed receipt on a pinned key. Prove it in this tab. Embedded-key verify is integrity, not authenticity, until you pin.

1. A grant can only narrow.A partner can re-delegate without a shared secret, never widen it. Revoking the parent ends every child grant and every bound session. tools/list is filtered to the tools that grant allows — the agent never sees a capability it was not granted. Authority is the control plane, not a note in a log.
2. The path, not only the hop.Untrusted content that entered the session can walk to an irreversible or egress sink. A poisoned resources or prompts read, or a notification, taints that path the same way a tool result does. Under the hardened profile the path is held or refused until a person breaks it. The operator sees which source tainted the path. An operator can also name an ordered sequence of tools; completing it is held or refused. A hold can preview the next hop when the connector can dry-run. pyxgrant unwind runs verified inverses; what cannot be compensated stays on the desk. pyxgrant demo -consequence-close walks a clean post, a scorer-miss read, then the same sink refused on provenance — synthetic estate, stated in the command. That walk is the Go binary, not the in-browser Try (still 2.900 WASM).
3. Freeze every plane.One command holds tool, model, A2A, and AG-UI traffic — including sampling and elicitation responses already in flight, and mid-stream, tool-result, and A2A-response legs. Freezing a parent grant expands over the grant lineage, so child-bound legs on those planes are held too. Resume is reversible. Revoke is not. Console Assurance can replay the signed session and seal a recovery drill without running undos.
4. N keys, and what they saw.A rule can require N distinct Ed25519 approver keys, each bound to the exact payload and to the rendering shown to the person. The Slack and Teams card shows a prefix of that shown hash. A shared-secret HMAC name does not count toward a quorum. The first valid deny refuses the call. Silence means no.
5. FinOps on the hop.The model proxy meters cost and rate per identity. A spent budget is refused before the provider. A spike can freeze the grant. pyxgrant payback lists prevented events you can re-derive — a spawn refused, a herd block, a cache hit — as exact counts or labelled estimates, not your invoice. payback prove dumps that ledger as an offline pack. LLM cache hits book avoided tokens as labelled estimates. showback -by grant -rollup folds child spend into the parent. This is not a SIEM or SOAR. Accounting-uncertain stays recorded. FinOps →
6. Prompt injection, then the consequence.Inbound text is scored with patterns and a local classifier. Prompt injection is not solved; new phrasing can pass. Under the hardened profile, untrusted content that then walks to an irreversible or egress sink is held or refused; injection then an outbound call is blocked even without the lethal-trifecta private-read; flag-level ingress injection is blocked, not recorded-and-allowed; a memory write that launders an untrusted directive is refused; an injection-driven block kills the grant on the request, the tool result, the error, and sampling. On the model plane, a tainted run that forces a tool call is refused before forward. A strong hit on any plane quarantines a fingerprint the others refuse. pyxgrant laptop -apply installs the managed hook and starts hook-daemon -engine -profile hardened. On Linux 6.7+ it launches the agent under Landlock. It does not pass -admin-approval; Command Center hold is a separate daemon flag. Windows discovers that daemon via hookpep.win.json. pyxgrant launch -confine, -confine-fs, and -deny-net bound a Windows child (job object, AppContainer, WFP) — not Landlock, and not a wrap of the whole laptop. A bare subprocess is still a smaller PEP. Pinning and a human hold sit behind the score. How it decides →
7. The bytes that run are the bytes approved.After allow, a mutated MCP, model, or A2A payload is refused. A valid approval with the wrong payload hash does not release the hold. The signature can bind the rendering shown, not only the bytes that will run. Only hops that hit the gateway.
8. After the act, more than the actor.A tool's ok:true is not enough. Declarative HTTP read-back, then N-of-M across independent providers. Too few confirmations is unverifiable and fails closed under hardened. A confirming read-back can mint a signed PhaseVerified receipt that closes the loop.
9. Kill names what died.Kill freezes the grant across tool, model, A2A, and browser serve. Memory Forget and RAG content-hash CRL when those stores are on. Grant-kill certificates go into the evidence pack and verify offline. Provider drop is kill:probed or UNVERIFIABLE — not a silent “killed.” IdP revoke is not claimed without a connector.
10. Pay only the approved cart.A swapped cart, a line-item swap at the same total, a tainted cart, or an amount over the cap is refused before your rail moves money. An opt-in signed payment mandate binds the cart so a goal from the environment is not enough. The model cannot talk its way past the ceiling.
11. Name the bypass. Prove the absence.Compare what we allowed with the provider's export and print each action that went around us. noninclusion signs that a declared action did not occur when coverage is complete. Optional coverage-gap quarantine and egress default-deny fail closed when traffic is supposed to go through us. evidence prove hands a skeptic one file, verifies it on a pinned key, and shows that a flipped byte fails. Verify binds the whole decision — principal, grant, verdict — not a detached stamp. Embedded-key verify is integrity, not authenticity, until you pin that key. That closes the loop after a refuse, not instead of one.

Where they are ahead: finding agents across SaaS platforms, and trained-model detection. We say that on Compare. Live authority and refusal is what we built to own. Compare, question by question →

1. DiscoverWho is running — then the decision, not the map
2. DecideThe path to the sink, not only the hop
3. ApproveN keys, bound to what they saw
4. ContainFreeze every plane; kill names the sinks
5. ProveName the bypass. Verify without us

1. FinOpsRefused before the provider; prevented events you can re-derive
2. Prompt injectionScored, then the path is held — not solved
3. Sensitive dataSecrets and records masked before the model