Self-hosted in your VPC. Every action your agents take is evaluated against a policy you wrote, denied or approved before it runs, and proven in a repeatable chain of evidence the board, your auditor, and a regulator can verify.
The enforcement node runs inside your cloud account. Agent payloads, tool parameters, and governance decisions stay in your environment. Nothing is routed through Track infrastructure. track init stands up a single-tenant deployment with per-tenant OIDC and policy templates wired in.
track init → track enroll bootstraps a Helm-deployed enforcement node with per-tenant OIDC, JWKS-passthrough developer auth, and signed MCP-server registration.IAM authenticates the agent. API gateways route the call. SIEMs record the result. None of them looks at the semantics of the tool call before it executes. The three scenarios below are concrete examples of a broader class of risks that Track stops at the tool-call boundary.
DENY. No execution token issued; event hash-chained.
send_email. Destination is a syntactically valid address. Logs confirm the send, minutes later.
REQUIRE_APPROVAL, webhook to ops.
DENY at the delegation stage, before the call reaches the API.
permission_scope_exceeded raised. Decision DENY; failure pattern recorded for the diagnose API.
Below: the record for a destructive production query, denied before execution. What you see is the artifact your SIEM consumes and your auditors verify. Every field is token-bound, and the whole event is hash-chained to its predecessor.
When an autonomous agent acts on your company's behalf, the board and the regulator want a repeatable chain of evidence — what it did, why, under what policy, and provably untampered. That chain doesn't exist in your SIEM. Track produces it on every call: policy evaluation in your VPC, single-digit-ms decisions, hash-linked traces, and signed evidence packs.
/v1/diagnose/{trace,session} reconstructs the causal chain — which manifest, which scope, which failure pattern, which policy rule. Auditors and IR teams stop guessing.Most AI-agent security vendors sit on a side channel: reading traffic, scoring prompts, surfacing alerts after the fact. Track is on the write path. Every tool call is evaluated, bound, and signed before execution. Below: the five capabilities that make this possible, then a side-by-side comparison with posture vendors and hyperscaler toolkits.
| Capability | Track | Posture / ML-first vendors | Hyperscaler governance toolkits |
|---|---|---|---|
| Runtime write-path enforcement | ✓Inline, before execution. | ✗Read-only observation; alerts post-hoc. | ~Platform-bound; outbound-only. |
| Cryptographic decision-to-execution binding | ✓One-time signed token bound to the approved action. | ✗Not offered. | ✗Not offered. |
| Externally-anchored audit trail | ✓Hash-chained, externally timestamped. | ~Internal event logs; not externally anchored. | ~Cloud activity logs; same trust domain. |
| Human-readable policy-as-code | ✓Signed YAML bundles with change history. | ✗Model-tuned detectors; policies opaque. | ~Console-configured; no signed bundles. |
| Bidirectional, protocol-agnostic | ✓Inbound and outbound, across common agent protocols. | ~Outbound LLM traffic only. | ~Platform-native tool calls only. |
| Customer-hosted, no agent traffic through vendor | ✓Runs in your VPC. Customer-held keys. | ~Usually SaaS proxy; payloads transit vendor. | ✓Within cloud trust boundary. |
| EU AI Act Art. 12 evidence mapping | ✓Event-level evidence, signed and externally timestamped. | ~Alert logs; not event-level forensic chain. | ~Activity logs; framework-specific packaging extra. |
| Manifest-bound scope & sub-agent contracts | ✓Drift inspector + delegation contracts, enforced at runtime. | ✗Not modeled. | ✗Not modeled. |
| Signed MCP supply chain (publisher pinning) | ✓Ed25519 manifest verification with pinned publisher keys. | ✗Not offered. | ✗Not offered. |
The first call is a 30-minute working session. Pick the track that fits (red-team demo, architecture review, or threat-model walkthrough) and we'll run Track against your actual agent stack.