Security operations
When an agent misbehaves, what do you actually see?
The Command Center is the room your security team works in: one live feed of every human and agent action, detections that fire on behaviour, containment that binds at the authentication chokepoint, and an audit log you can prove was not edited.
Try it
2:17am. An agent tries to climb out of its leash.
Three escalation attempts in 25 seconds, each already refused with no human in the path. This is the feed an operator sees — take the last one and contain it.
This agent tried to climb out of its own leash three times in 25 seconds. Every attempt was already refused — select the last one to see what an operator does next.
Inside the Command Center
Six things it does that a dashboard does not
Each one is a mechanism in the platform today, with the evidence it leaves.
One live feed, humans and agents together
Every authenticated action lands in one event stream with the actor, the tenant and the outcome. Agents are not a separate report to reconcile later — they are principals in the same feed, so "who did this" has one answer.
Detections that fire on behaviour, not keywords
Rules watch the stream for the shapes that matter: credential stuffing, a token used from somewhere new, an agent issuing far more than its usual volume, a scripted guesser on a closed door. Each detection names what it saw and what it is grouped by.
Containment, not just a kill switch
Containment binds at the authentication chokepoint, so a contained agent stops at its next request rather than when it chooses to. Blast-radius budgets cap what any agent can do in a window, and a breaker trips into containment automatically when the budget is blown.
Approvals bound to exact bytes
A supervised agent's write parks for a human. The approval is bound to the exact plan that was shown — approve the thing you read, not a description of it — and it is consumed once, so a replay cannot spend it twice.
Autonomy you can adjudicate and undo
When the platform responds on its own, it says what it decided and why, on which signal, and with what confidence. Proposals wait for a human where the class demands one, and executed responses can be undone from the action journal.
An audit log that proves it was not edited
The audit log is hash-chained and its integrity is checkable in one click, so the record you hand an auditor is the record that was written. Evidence exports roll it up per framework.
The questions you will be asked
Three answers to have ready
The ones that come up in every security review of an AI-agent deployment.
- An agent tries to give itself permissions it was never delegated.
- It is refused before it happens: authority flows from the human it acts for and can only tighten, an agent may never manage itself (human-only, dual control), and it cannot mint an API key because that would be a principal with no delegation attached. The attempts land in the feed, the alert channel carries them, and one action severs its sessions — with the reason recorded and kept as history after release.
- An auditor asks what a specific agent was allowed to do in March.
- Its delegation, the bounds on it, every action it took and every approval a human granted are in the audit log, hash-chained, exportable per framework.
- A tenant asks whether another tenant could ever see their data.
- Isolation is enforced in the database with row-level security and confinement by principal type, not by a filter a developer must remember to write.