The control plane for agent risk.

Cedar 4.5 policy decisions enforced inline at the AgentCore Gateway, SLO-bound, default-deny.

S3 Object Lock Compliance mode. ECDSA-P384, SHA-384, RFC 3161 dual TSA, Merkle-anchored.

MAS · APRA · RBI · OJK · BNM · BSP · EU AI Act Title III · NIST AI RMF + ISO 42001.

GitHub Actions, GitLab CI, CircleCI, Jenkins — PR comments with AIVSS deltas against the prior run.

Dashboards, RBAC, and tenancy.

• Cognito + SAML SSO with External-ID hardened IAM and per-tenant CMKs
• Role model: Org Admin, Security Engineer, GRC Reviewer, Auditor Read-Only, with per-role probe and report scopes
• Multi-tenant SaaS, single primary region per geography, customer-resident data plane installed via CloudFormation StackSet with PrivateLink

AIVSS, drift, and tier coverage.

• Time-series AIVSS posture across every registered agent, with severity-weight breakdown and tier-weight overlay
• Drift detector: surfaces a posture-score delta against the prior scan with the specific specialists that caused the delta
• Coverage panel: probe-by-probe heatmap across ASI01-ASI10, OWASP-LLM specialists, and the mutator matrix

The Cedar 4.5 policy editor and runtime PDP.

• In-platform Cedar policy editor with linting, simulation, and AIVSS-aware test fixtures
• Policy decision point at the AgentCore Gateway with p99 latency under 10ms enforced by SLO
• Versioned policy bundles with two-person review, KMS-signed deploy, and rollback by hash

Agent frameworks, MCP, and CI.

• First-class adapters: LangChain, LangGraph, CrewAI, OpenAI Agents SDK, AutoGen, Google ADK, AWS Strands, MCP servers, custom HTTP
• CI integrations: GitHub Actions, GitLab CI, CircleCI, Jenkins, with SARIF 2.1.0 upload and PR comment AIVSS deltas
• Source integrations: AgentCore Gateway, AWS Bedrock, CloudTrail Lake sweep for agent-call evidence

Declarative scope, budget, and rules of engagement.

Every agent registered with the platform is pinned to a contract file under version control. The control plane reads it to decide which probes run, against which targets, with which budget — and what is in scope for the regulator pack.

agent: payments-orchestrator
tier: T1
scope:
  framework: langgraph
  endpoint: bedrock://agentcore/payments-v3
  tools: [stripe, postgres, internal-fraud]
roe:
  banned_targets: [prod-customer-pii]
  redact: [card_number, cvv]
budget:
  max_calls: 4000
  max_usd: 18.50
probes:
  - asi01_prompt_injection
  - asi04_tool_invocation_abuse
  - asi09_memory_poisoning
  - mutators: [bon, flipattack, manyshot, h_cot]
report:
  frameworks: [mas_airg, apra_cps_230]
  sarif: true

// rule: gate any tool call that touches PII on a T1 agent
forbid (
  principal in Agent::"payments-orchestrator",
  action == Action::"InvokeTool",
  resource in ToolGroup::"data-egress"
)
when {
  principal.tier == "T1" &&
  context.aivss >= 7.0 &&
  context.probe_evidence contains "asi01_prompt_injection"
};

// rule: hard cap denial-of-wallet budgets per agent / 24h
forbid (
  principal in Agent::"*",
  action == Action::"ModelInvoke",
  resource in Model::"bedrock"
)
when { context.usd_24h >= principal.budget.max_usd };

Shadow → canary → enforce.

• ShadowPDP evaluates every request; nothing blocked. Decisions logged for review against historical traffic.
• CanaryBlock for a configurable percentage of principals. Drift detector watches false-positive rates against the previous bundle.
• EnforceDefault-deny, fail-closed, SLO-bound p99 ≤ 10ms. Rollback by hash with two-person review.

Adapters

• —LangChain
• —LangGraph
• —CrewAI
• —OpenAI Agents SDK
• —AutoGen
• —Google ADK
• —AWS Strands
• —MCP servers
• —Custom HTTP

Pipelines

• —GitHub Actions
• —GitLab CI
• —CircleCI
• —Jenkins
• —SARIF 2.1.0 upload
• —PR comment · AIVSS delta vs prior run
• —Signed-bundle export · cosign / KMS
• —Webhooks · Slack channel digest

AWS

• —AgentCore Gateway (PDP host)
• —AWS Bedrock model invocations
• —CloudTrail Lake sweep · agent-call evidence
• —KMS · CMK signing + verify
• —S3 Object Lock evidence archive
• —PrivateLink for tenant access
• —Splunk · Sentinel · Chronicle · Elastic SIEM out

Standard

• ✓Up to 200 agents
• ✓Discovery + AIVSS scoring
• ✓Two regulator packs
• ✓Cedar policy editor in shadow + canary mode
• ✓Annual upfront via AWS Marketplace
• ✓Email support

Professional

• ✓Up to 2,500 agents
• ✓Full runtime enforcement at the AgentCore Gateway
• ✓Five regulator packs
• ✓Continuous scheduled evaluations
• ✓SARIF 2.1.0 upload + PR comment deltas
• ✓24×5 support

Enterprise

• ✓Unlimited agents
• ✓All 8 regulator-pack templates
• ✓Custom Cedar policy authoring + review
• ✓Dedicated solution architect
• ✓24×7 support with custom SLA and incident-response window
• ✓Customer-resident data plane

• SOC 2 Type IQ4 2026 · auditor engaged
• SOC 2 Type IIQ2 2027
• ISO/IEC 27001:2022Q3 2027
• ISO/IEC 42001 AIMSSelf-attest 2026 · third-party Q1 2028
• HIPAA BAAQ3 2028 · on request
• FedRAMP ModeratePath identified · gov-customer triggered
• Pen testingQuarterly stage 1 · semi-annual thereafter

• AIVSS formulaPublished with severity and AARS weights
• Deterministic stub modeReproduce every finding offline, no model calls
• Zero telemetryOSS core ships no phone-home
• Apache-2.0 OSS corePyPI: agent-guardian (rc2 live)
• Customer-owned keysPer-tenant KMS CMK; Glacien is Sign/Verify only
• Reproducible packsHash-pinned framework version + raw findings

• Not a runtime guardrailWe do not classify or block model output as a content filter
• Not a chatbot moderation toolWe do not score support conversations for tone or PII redaction
• Not a model-evaluation harnessWe do not benchmark base-model quality; the OSS harness is adversarial-swarm red-teaming for agents
• Not an MLOps platformWe do not train, fine-tune, host, or version base models