The engine behind Track, end to end: how it builds an evidence-backed reachability map, inspects risky actions, enforces the decision inline, drafts missing policy, and turns every outcome into a checkable receipt with a one-line config change, not an SDK.
Find the complete agent-to-resource graph, inspect the risks ordinary access controls miss, stop unsafe actions before execution, and keep signed evidence of every outcome.
Every path, allowed or denied, ends the same way: a signed receipt.
Track deliberately does not own two of these four boundaries. The record is not a boundary at all, and the four-tier framing has no answer for it.
Deciding needs rules, and day one starts without them. Autodraft turns the discovered estate and the traffic Track has already seen into reviewable draft policy, while keeping a hard line between drafting and deploying.
No model writes a rule, and no draft deploys itself. The loop ends with an explicit decision made by a person, just like the runtime.
The estate keeps moving: Autodraft re-checks coverage as agents and tools appear, and flags rules whose surfaces have gone stale.
No SDK. No code change. Just point the agent's MCP config at Track.
Same agent, same server: only the path between them changes.
Inline on the action path. Latency measured against your traffic, not a headline number.
Pick one agent with real write access. We'll map it and show you the receipts.
Design a pilot