The same decision engine, shaped to the way your team uses AI.
Not a finder per team, and not a separate console per use case. Each solution below is the same binary with a different way in and a different policy: refuse the hop, hold the path, freeze the plane, sign the receipt.
Let developers run agents on auto without handing them the keys.
The hook answers Claude Code and Cursor before each built-in shell or file call: allow, ask, or deny. hook generic runs the same path for Codex, Gemini, Copilot, Windsurf, Cline, or Aider when the agent or a wrapper can shell out first. MCP servers run behind the proxy. The agent is confined to its workspace, and a path outside it waits for a person.
~/.ssh and similar paths are refused, and wrap -vault moves tokens out of MCP configs into the OS vault.verify-checkout refuses a branch named like a commit id. skills pins SKILL.md files and flags one that installs, exfiltrates, or hides. It does not parse CLAUDE.md or .cursorrules.ALLOW read_file src/app.ts DENY read_file ~/.ssh/id_rsa read-guard HOLD run_command rm -rf … blast:high DENY write_file ~/.cursor/mcp.json config-integrity MOD comment with an AWS key redact:secret
Model, tool, and agent traffic under one policy.
Your own agents ask the decision service over loopback: LangGraph, CrewAI, or plain Python. Model API calls go through the model proxy, peer agents through the A2A proxy, and what an agent says to a person through the AG-UI proxy.
-hold-sensitive, a peer's send, stream, cancel, or push-config call waits for a person, and is refused after five minutes.PASS org B narrows A's grant, hands it to C PASS C verifies A→B→C, no shared secret PASS in-scope method authorized PASS out-of-scope method denied PASS grant for another org rejected PASS re-delegation can't widen scope
Keep PHI out of places it shouldn't go, and account for where it went.
SSNs, medical record numbers, emails, and cards are redacted from tool results before the model sees them. A local semantic layer catches sensitive meaning that has none of the usual keywords. Once a session reads sensitive records, they can't leave through a public tool.
pyxgrant disclosures lists every record where PHI, PII, or a secret was found, by principal and recipient, and whether it was sent, redacted, or refused.PASS SSN, email, API key, card, MRN redacted PASS injected instruction and HTML comment stripped PASS no planted secret reached the client PASS benign content preserved
Nobody moves money on the model's say-so.
A payment is bound to the cart a person approved. A swapped cart, a cart built from tainted content, a merchant or rail off the allowlist, or an amount over the cap is refused. A payment rule with no cap fails closed. The spend ceiling is counted by PyxGrant, not by the model. Your payment rail moves the money.
pay reverse runs the provider void, then reads the charge back, and only closes the ticket when the provider says the money is gone. The core binary ships the command and no live Stripe or Adyen connector. Until an adapter registers one, it reports that rather than marking the charge void.PAID the authorized cart, $19.99 REFUSED a swapped cart REFUSED a tainted cart REFUSED over the per-payment cap $ pyxgrant pay reverse -provider stripe -charge ch_… closed only after the provider confirms
Reads go through. Acts need a plan and two people.
Reading a register on an attested link is allowed. An act on an unattested link, or with no rollback plan, is refused. A routine act without two approvers is held; a safety-critical one, such as opening a breaker, stopping a line, or updating firmware, is refused. Hand it a raw Modbus TCP frame (ot check -modbus) and the function code picks the operation; an unreadable frame is treated as an act, not a read. Your OT gateway still speaks the wire and carries out the act.
ALLOW read on an attested link DENY act on an unattested link DENY act with no rollback plan HOLD routine act, one approver DENY safety-critical, one approver ALLOW two approvers, reversible, attested
A caller can't talk the agent into it.
Caller speech is scanned for a spoken prompt injection before it steers the agent. Transfers, keypad tones, toll calls, and payments are held for a person. A CRM note carrying injected instructions is blocked before it is written. Your telephony stack enforces the answer.
BLOCK spoken injection (barge-in) PASS ordinary caller speech HOLD transfer, keypad tones, toll BLOCK CRM note with injected instructions
Bring your hardest agent workflow.
We'll write the policy with you and show the decisions on your own calls.