Why we built this

We watched agents move from autocomplete to autonomous action inside real engineering organisations. Within a year the same tools that suggested a line of code were reading credentials, running shell commands and writing to internal systems without a human approving each step.

What we did not see was any way to answer the question that follows. Security teams asked what an agent had done, and the only available answer was the agent's own log — written by the thing under investigation. That is not evidence. It is a self-report.

So we built two controls that do not depend on the agent cooperating. One bounds what it can reach while it runs. The other records what it actually did, read from the kernel rather than from anything the agent chose to write down. The record is a by-product of the enforcement, which means it exists whether or not anyone thought to turn it on.

Draft — founders to review and sign off