Security

The safest content is the content the control plane never needs.

The pilot evaluates bounded, customer-supplied evidence against a policy revision assigned to your account. It stores decision records for your review and never retrieves target pages.

Pilot controls

Current pilot surface

Fixture-only sandbox with no arbitrary URL fetch
Server-side lead submission boundary
Security headers and no client secrets
Explicit sample and pilot labeling
Hashed, scoped credentials with tenant-bound policy revisions
Tenant decision history, exports and usage limits

Required before enforcement

Production controls

Isolated egress and SSRF controls
Independent evidence verification and decision-record signing
Automated policy administration and review workflow
Customer-side enforcement adapters and integration validation

Enterprise roadmap

Assurance program

SSO, SCIM and granular access roles
SIEM export and retention controls
Independent penetration testing
SOC 2 readiness and vendor review pack

Target architecture principles

A narrow trust boundary by default.

Observe at the customer edge · planned

A separately scoped customer-side component would capture the response delivered to its identity, IP, region and authentication context.

Store bounded evaluation records

Decision history retains sanitized decision metadata and evidence digests under your tenant. Raw resource URLs and evidence claims are omitted from stored records and exports. Submit only the sanitized metadata agreed for the pilot; full page bodies are outside the request schema.

Keep authorization on the server

The customer workspace holds a pasted key only in page memory. It sends it to same-origin API routes, with no browser storage or URL parameters. The server applies scopes, tenant ownership and usage limits; records are unsigned.

Make uncertainty executable

Missing, stale or conflicting supplied evidence resolves under customer policy to deny or review. No source cache or cached fallback exists in the pilot.

Managed collection boundary

Arbitrary retrieval requires its own isolated service.

The public web service does not implement collection. The planned model is on-demand: request only relevant published policy signals for a customer resource, selectively cache them for a bounded freshness window, and never crawl or mirror the whole web.

SSRF is a release blocker, not a rate-limit problem.

Before any collector ships, it must reject loopback, private, link-local, metadata and reserved ranges after every resolution and redirect. Authenticated/private resources remain outside its proposed initial scope.

Need a security review?

Bring your architecture and vendor requirements into the pilot.

We will map the production control gaps before asking you to place AgentGuard in an enforcement path.

Discuss requirements Read the contract