Detect, prevent and correct rogue AI agents.

Every agent is registered with its purpose, the data it reads, the guardrails that hold its work and the person accountable for it. The register is generated from the running agents, not typed into a spreadsheet, and the public transparency statement is produced from it.

Who may decide what, and up to what amount, is loaded from the instrument of delegation. An agent cannot inherit an authority no person holds.

Each service carries named guardrails: a code, the rule in plain words and the line of code that enforces it. Agents stop at them, and the register is public on every service's governance page.

Rules, thresholds, eligibility and deadlines are evaluated deterministically. A language model is used only where it is configured to draft or summarise, never to decide, and every run records which engine ran it.

A charter that also names the tools an agent may call, the actions it may take, its spend ceiling and its rate, enforced before every call rather than reviewed after it.

When an agent reaches a decision with legal effect it holds, names the guardrail, the risk and the role that must decide, and stops. A person approving that hold is the only code path that executes the effect.

One central check runs before any decision takes effect, with monetary limits. An attempt beyond the limit is refused with the limit named, and the attempt is logged.

Every model call an agent makes through the Meshbone gateway is checked against its policy before it reaches the model: ours, a vendor's, or one your own team built, wherever it runs. Bringing an agent under guard means pointing it at the gateway with a base URL and a token, not rebuilding it. A call outside policy is blocked, not written up later.

Text an agent reads in a document, a feed, an email or a web page is treated as data. It cannot redirect the agent's charter. Inputs are validated and outputs are held for a person, which is the design answer to prompt injection and excessive agency.

An agent reads only what it is cleared to read. Personal information is redacted before anything publishes, financial identifiers are stored masked and hashed, and Databallast classification and lineage say what a field is and whether it may be used.

The agent or person that prepares a thing cannot be the one that approves it. The reviewer of a decision is never the original decider, and the certifier is never the signer.

Where one agent calls another, the authority of the chain is the lowest authority in it, checked at every hop. No agent gains a permission by asking a colleague.

The one step in a run that talks to a model runs inside a kernel-level sandbox outside our own code: it can read only the files it was given, reach only the endpoint its charter names, and never holds the real credential, which a broker outside the boundary adds to the one approved request. Everything else is refused before it happens and recorded. Prototype exercised on 30 September 2026 with NVIDIA OpenShell, open source under Apache-2.0.

An agent's reasoning is recorded as numbered steps with the actor, what it did and why, the records it read and the engine that ran it. A person deciding a held matter sees the steps before deciding.

Every attempt to decide, allowed or refused, is on the record with the limit that applied. The internal audit agent reads that log as evidence, so the control is tested by the software itself.

Every audit event is hash-linked to the one before it, across every product in the compendium. An agent, or a person, that alters a historical record breaks verification from that point, and verification runs on every overview.

Meshbone finds agents and services that are not on the register and detects drift from the approved configuration. AIG Sentinel surfaces the AI already in use across the organisation, including the AI hiding in everyday tools.

Runs, holds and human decisions per agent, and the provider, model, region and cost of every model call, in one view from first request to retirement.

Each agent's normal is learned from its own record: action mix, volume, cost, refusal rate and the data it touches. A departure raises a signal in the risk register and, past a threshold, a hold.

Repeated identical actions, duplicate effects, retries past a ceiling and spend past the charter are stopped and surfaced, with the run that caused them.

The refusal test suite runs against live agents on a schedule, not only on the build, so a control that has stopped working is found by us before it is found by an auditor.

Stop an agent, a service or the whole estate from Meshbone, including agents built elsewhere that call their model through the gateway. The stop is immediate, and it is on the record with who pulled it and why.

Every agent has a lifecycle from request to retirement, with re-attestation to keep its approval current. An agent that no longer meets policy is retired rather than tolerated.

A decision overturned on review requires a lesson, and the lesson opens a rules feedback item, so the correction reaches the rule the agent runs on and not just the case.

An agent that trips a guardrail it should never have reached is confined: it can read and draft, it cannot act, and everything it had queued is held for a person. On hardware with an NVIDIA BlueField-4 DPU, NVIDIA's Sentry reference design adds an out-of-band watchdog that can quarantine an agent in silicon, in milliseconds.

What an agent did is reversed from the evidence chain, record by record, then re-run under the corrected charter with the two results compared.

Every stop, quarantine and rollback is an incident on the chain: who stopped it, why, what was reversed, what changed in the rule, and who signed the return to service.