How Aigentical governs what agents do.
The detail behind the homepage: how one call is decided, where Aigentical sits, the guarantees it makes, how it works with your identity stack, and how it finds the AI nobody set up.
Content security stops at the prompt. We govern what happens next.
Chat-era tools were built for text in, text out. The real risk now lives in what an agent does after the model speaks: the tool calls, the deletes, the refunds, the handoffs. That is the layer Aigentical runs on.
Runs, in path
support-agent · look up order
Low-risk actions run as soon as your policy says yes.
Waits for a human
billing-agent-v2 · wire $50,000
Runs only after a single-use approval the agent can't forge.
Stopped before it runs
sre-agent-v1 · delete prod-db
Refused at the gate. Nothing reaches the system.
All three are written to the tamper-evident record, with the agent and the rule that decided.
- Stage 1Identity & context
- Stage 2Input & injection shielding
- Stage 3Policy & authorizationdeny → stopped here · still recorded
- Stage 4Blast radius & boundaries
- Stage 5Data, DLP & the record
An attacker has to beat every enforcing layer on the surface they are on.
Which layers run where
Four places it enforces. One decision point.
You already run guardrails and probably a gateway or two. Aigentical doesn't replace them. It is the one place every action is decided, so governance doesn't fragment across them.
Shared governance runs behind the LLM proxy, MCP intercept, the Actions API & SDK, and the RAG firewall. Agent-to-agent hand-offs are checked on the LLM proxy, MCP intercept and Actions API & SDK paths. Add a surface, not a rewrite.
And you can make the LLM proxy the only road.
Some controls you configure. Some nobody can turn off.
The split is architectural. One set is a guarantee that holds on every surface. The other is tuned per customer, per agent and per surface.
Identity on every action
Each action is attributed to the agent that made it, with how strongly its identity was proven. A weak proof is never recorded as a strong one.
A record that shows any edit
Every decision, allowed or refused, is chained so a changed or deleted entry is detected. No setting re-signs a forged entry.
Approvals that can't be forged
A human approval is single-use and bound to the call it approved. It can't be replayed or spent on another action.
Always scanning
In monitor mode every check still runs and still records. It just doesn't block.
Tool allowlists and blast radius
Which tools each agent may call, and how much one call may touch.
Approval thresholds
Which actions wait for a human, and at what data sensitivity.
Reputation floors
Refuse an agent whose behaviour has dropped its trust below your floor.
Monitor or enforce
Record what would be refused, or refuse it. Switch when you're ready.
Your IAM lets the agent in the door. We govern everything it does after.
Authentication is the front door. The risk is the action. Aigentical consumes the identity signal you already issue and makes it enforceable at every single call.
Your identity stack, unchanged
No rip-and-replace. We sit on top of the IAM you already run and make it enforceable at every agent action.
- SPIFFE SVIDs · mTLS · OIDC & SAML SSO (Keycloak tested; Okta and Entra through standard OIDC)
- SCIM provisioning · your own encryption key for secrets at rest, or HashiCorp Vault
- Works alongside your IdP through OIDC, SAML and SCIM: additive, not a replacement
Runtime authorization
- Every call gets a verdict and a reason.
- Least agency: each call must pass the allowlist, the blast-radius limit and, under enforcement, the reputation floor.
- Hand-offs between agents are checked hop by hop; the chain's lowest trust, not its most trusted agent's, is what can gate the call.
Claim-pinned identity
- When an agent presents several proofs of identity, the strongest one wins.
- Tokens are environment-pinned, so a dev token can't act in prod.
- Header-only identity is recorded as asserted, never promoted to a stronger grade, and can be refused for risky tools.
See every AI call, including the ones nobody set up.
Most teams can't name all the AI running inside them. With discovery switched on, Aigentical finds the rest before a single policy runs, surfacing agents and AI calls on your network or under your provider accounts, including the shadow AI nobody set up.
Six angles, one reconciled inventory. Start in monitor mode and watch first, then enforce — globally, or policy by policy. See everything first, then enforce where it matters.
Built for the frameworks your program already answers to.
The obligations your program is measured against, and the runtime-governance model analysts describe (Gartner AI TRiSM, Forrester AEGIS), stated as controls, not positioning.
ISO 42001 and NIST AI RMF are mapped as representative subsets; MITRE ATLAS appears as technique tags on threat patterns.
Mappings are Aigentical's own: evidence for your program, not a certification. Aigentical is not itself certified or audited against these frameworks. TRiSM, AEGIS, and AIUC-1 are frameworks and standards of their respective owners; the mappings do not imply review, endorsement, or certification by Gartner, Forrester, or AIUC.
See it on your own traffic.
Start in monitor mode, watch every decision get recorded, and decide what to enforce once you've seen it. We deploy it with you.