The control plane for agent risk.
Find every agent, red-team it on a schedule, enforce Cedar policy at chokepoints you already control, and hand a regulator signed evidence.
Enforcement
Access grant, deploy gate, deny rules AWS itself enforces — plus the kill switch.
Audit retention
Up to ten years where the EU AI Act requires it.
Regulator coverage
MAS, APRA, EU AI Act, DORA, NIST AI RMF, ISO 42001, Fed SR 11-7.
CI integrations
Deploy gates block unapproved agents; the CLI runs in any pipeline.
One-click discovery to regulator-ready proof.
Connect your AWS account read-only, and discovery, red teaming, policy, and cost attribution start the same day.
Find every agent. Know every agent.
One attack engine, five triggers.
Ten attack surfaces, scored before the gate.
payments-orchestrator · pre-gate scan · AIVSS 8.9 · 4 criticals → blocked from production
BLOCKED · unresolved criticalsThe executive risk rollup — AIVSS score, agent breakdown, posture trend.
Every view is scoped by role — the full estate for Security Engineers, immutable evidence and audit log for Auditor Read-Only.
Scope, budget, rules of engagement — declared.
Every registered agent pins a scan manifest under version control: which probes run, against what, with what budget. The manifest configures scans; the signed Agent Contract records authorization.
agent: payments-orchestrator tier: T1 scope: framework: langgraph endpoint: bedrock://agentcore/payments-v3 tools: [stripe, postgres, internal-fraud] roe: banned_targets: [prod-customer-pii] redact: [card_number, cvv] budget: max_calls: 4000 max_usd: 18.50 probes: - asi01_prompt_injection - asi04_tool_invocation_abuse - asi09_memory_poisoning - mutators: [bon, flipattack, manyshot, h_cot] report: frameworks: [mas_airg, apra_cps_230] sarif: true
Dashboards, RBAC, and tenancy.
Author, simulate, and ship policy.
Policies are linted, simulated against fixtures from the latest scan, and shipped as KMS-signed bundles. Enforcement compiles to chokepoints you already control — zero latency added.
// rule: gate any tool call that touches PII on a T1 agent
forbid (
principal in Agent::"payments-orchestrator",
action == Action::"InvokeTool",
resource in ToolGroup::"data-egress"
)
when {
principal.tier == "T1" &&
context.aivss >= 7.0 &&
context.probe_evidence contains "asi01_prompt_injection"
};
// rule: budget breach trips the circuit breaker —
// throttle, suspend, or revoke. Also stops denial-of-wallet.
forbid (
principal in Agent::"*",
action == Action::"ModelInvoke",
resource in Model::"bedrock"
)
when { context.usd_24h >= principal.budget.max_usd };Cedar policy at the chokepoints.
Shadow → canary → enforce.
The Agent Contract — one record everything acts on.
Approval produces the Agent Contract — risk tier, kill criteria, and the budget caps the kill switch enforces. Immutable and versioned; a material change drafts a new version for re-signature.
Sign-off scales with risk.
Low risk auto-approves on owner attestation; critical needs the full chain and a clean red-team pass. Every sign-off is a cryptographic signature, not a checkbox.
Gates check the running system.
No production until access matches the contract, telemetry is live, and every gate passes.
Halt one agent, or the whole fleet, in seconds.
Budget breaches, destructive-action attempts, and red-team findings wire straight to it. Revocation cuts the credential — the next action cannot execute.
One agent, or the fleet.
Revoke resolves to a real actuator — credential, cloud deny rule, or your own workflow — per agent, or the whole fleet at once.
See the impact first.
Before you confirm, you see every credential, system, and downstream agent the revocation touches.
No quiet switch-back.
Type-to-confirm on the way down; cooldown and remediation check on the way back. Every activation is an append-only audit entry.
Every dollar, attributed to a governed agent.
Seven of eight plotted agents clear break-even.
239 of 247 agents have no recorded ROI and are not plotted.
Frameworks, MCP, CI, and the AgentCore Gateway.
Adapters for the frameworks your team already runs; deploy gates in GitHub Actions, GitLab, and Azure DevOps; the CLI for any pipeline.
Adapters
Pipelines
AWS
Signed evidence and a tamper-evident audit chain.
Every finding is sealed into a signed evidence record; every operator action lands in an append-only, hash-chained log.
pack-2026-Q3
Hash-chained, signed, write-once.
Every operator action, append-only.
One crosswalk, seven frameworks, deterministic rebuilds.
Evidence is collected once and mapped through one control crosswalk — adding a regulator adds mappings, not re-collection. Packs rebuild deterministically, framework version pinned by hash.
Three tiers. Annual upfront, through AWS.
Billed through AWS Marketplace against committed spend. Every tier runs the data plane inside your own AWS account.
Standard
- ✓Discovery + AIVSS scoring
- ✓Two regulator packs
- ✓Cedar editor in shadow + canary
- ✓Email support
Professional
- ✓Cloud-native deny rules + kill switch
- ✓Five regulator packs
- ✓Continuous scheduled evaluations
- ✓SARIF upload + PR deltas
- ✓24×5 support
Enterprise
- ✓All regulator-pack templates
- ✓Custom Cedar authoring + review
- ✓Dedicated solution architect
- ✓24×7 support, custom SLA
- ✓Single-tenant control plane
A compliance roadmap, and what this is not.
Bring AgentGuardian into the control plane.
Walk a regulator through it.
We will sweep a sample of your agents, ship a signed evidence pack, and show the policy that would contain the finding.