Defense
Runtime policy enforcement
Intercepting every tool call, API request, and agent action before it executes — and blocking anything not explicitly permitted by policy. The only control that operates after an agent has decided to act. Allowlist-only: everything not permitted is blocked by default.