Agent trust layer
Each agent is somebody in its own right
If an agent acts as the person who configured it, then every agent has that person’s access, "pause that one" means nothing, and the audit log records a human for something no human did. Separating the two is what makes the rest of the trust layer possible.
14-day evaluation · no card · start before you connect anything
Every request passes through, in order
- 01Agent identityYou are here
- 02Permissions and policy
- 03Risk and approvals
- 04Action gateway
- 05Tenant isolation
- 06Prompt-injection defence
- 07Credential protection
- 08Audit and decision ledger
- 09Kill switch
Uncertainty at any step resolves to a refusal or to asking a person — never to proceeding.
How a request is decided
- 01Its own credential, not a borrowed oneAn agent authenticates as itself. A leaked workspace token is the workspace; a leaked agent credential is one agent, and revoking it stops that one without disturbing anything else.
- 02Its own ceilingsEach agent declares the highest risk it may ask for and the most sensitive class of data it may handle. An action declaring more than the agent is allowed is refused by the gateway regardless of what its permissions otherwise say.
- 03Ceilings are per agent, deliberatelyOne agent reads messages members of the public wrote; the others read business figures. A single ceiling wide enough for the first would silently widen all of them, so each says what it needs and no more.
An agent credential
Example
- Acts as
- Retention agent
- Highest risk it may ask for
- Low — it proposes, it does not send
- Most sensitive data it may touch
- Business figures. Not one person’s details
- Revoked by
- Anyone with admin, immediately
A leaked workspace token is the workspace. A leaked agent credential is one agent — and revoking it stops that one.
What this guarantees
"Stop that one" actually means that one
Because identity is per agent, pausing or revoking is precise. You are not choosing between stopping everything and stopping nothing.
The record names the agent
Audit entries attribute work to the agent that did it rather than to whoever happened to create it, which is the difference between a log you can investigate and one you cannot.
Outside agents get the same treatment
An agent you build elsewhere can hold a credential of its own and is subject to the same ceilings and the same gateway as ours.
What it cannot defend against
Said plainly. A control whose edges are hidden is worse than no control at all.
An agent credential is not a person
It identifies the agent, not whoever is operating it. Where you need to know which of your people acted, that comes from the workspace role and the audit entry, not from the agent credential.
No per-agent network restrictions
Address allowlisting applies to the workspace rather than to an individual agent credential.
Every control, and what is not built
The security page lists each control as something you can check in the product, and lists separately what is not in place — including that Xyranik holds no certification and has had no external audit.