Automated response
When something fires, respond in the same second.
Response rules evaluate every governed event. A rule that matches can quarantine an agent, revoke its keys, or raise an alert. Start in monitor mode to watch what would happen, then arm it.
Monitor or armed · per-agent cooldown · only quarantine is reversible
Predicates
A rule fires when everything matches.
Stack as many conditions as you need. A rule only acts when all of them hold at once.
Match the call
A tool pattern, a risk floor, a signal category, or an exact detector id.
Require critical
Only act when a live secret, a private key, or a forged signature is present.
Across a window
Wait for a count, like five matching events within sixty seconds, before acting.
Two modes
See it first. Arm it when you trust it.
Every rule runs in one of two modes, so you can prove a rule is right before it ever touches an agent.
Watch what would happen
Monitor records a simulated action and logs what it would have done. It runs on every plan and never touches an agent.
Act the moment it matches
Armed takes the real action as soon as a rule fires. Available on Pro and above.
Reversible by design
Simulate
Build a rule, then replay a feed of events through it.
Compose a rule, stream a sample feed, and flip between monitor and armed to watch the same engine decide which events trigger an action.
Your response rule
Simulate only
Take real action
Event feed
Monitor records a simulated action. Armed takes the real one.
What can fire a rule
Per call, across a chain, or after the model weighs in.
Rules evaluate on more than single calls. The most dangerous behavior shows up across a sequence.
Per tool call
The default. Every governed call is checked against your rules as it happens.
Kill chain
Correlated exfiltration across calls, synthesized as one max-risk event.
Correlated attack
One call looks fine. The sequence is the attack.
Add calls to a run and watch a kill chain fire when a sensitive read is followed by egress, when reconnaissance precedes a delete, or when an injection leads to an action.
Add a few calls. One looks fine on its own. Try a sensitive read followed by a POST, or three reads then a delete.
No double-acting
Cooldowns and idempotency keep it calm.
Automation should be decisive, not noisy.
Built-in safeguards
Keep exploring
Continue across the control plane.
Stop watching dashboards. Let the rules act.
Prove a rule in monitor mode, then arm it to contain a bad agent the second it crosses the line.