Your agents can act.
Now they need a warden.
Warden is the control plane between your AI agents and everything they can touch. Every tool call carries an identity, clears a policy, and leaves an audit record — so an injected instruction never becomes a refund, a deletion, or a data leak.
▼ Live demo · real UI · synthetic data — click around
↔ drag the console sideways to see the rest
Warden is pre-launch. The console above is a working simulation of the product running synthetic traffic — not a live customer environment. Design-partner slots are open.
Intercept. Decide. Prove.
Warden sits in the path of every tool call an agent makes. No model changes, no prompt rewriting, no agent framework lock-in.
Intercept
Point your agents at the Warden endpoint instead of calling tools directly. It speaks MCP, OpenAI tool-calling and plain HTTP, so nothing in your agent code has to change.
- MCP server proxy
- Tool-call gateway
- Egress broker
Decide
Each call is checked against the agent’s identity, data classification, spend caps and blast-radius limits — then allowed, held for a human, or blocked, in under fifteen milliseconds.
- Per-agent least privilege
- Injection-aware content tagging
- Human-in-the-loop approvals
Prove
Every decision leaves a signed record: who asked, what was attempted, which policy fired and why. Replayable end to end, and mapped to the frameworks your auditors already use.
- Tamper-evident action log
- Chain reconstruction
- NIST AI RMF / EU AI Act evidence
Every tool call goes through one door.
Agents call tools through Warden instead of calling them directly. It speaks MCP, OpenAI and Anthropic tool-calling, plain HTTP and gRPC — so LangGraph, CrewAI, a bare SDK loop or something you wrote yourself all work without a rewrite.
- MCP proxy — drop-in in front of any MCP server, per-tool entitlements
- Tool-call gateway — one base-URL change in your agent
- Egress broker — the only route to the public internet
- Sidecar or hosted — same policy engine in both
An agent is not a user. Stop giving it a user’s keys.
Most agents run today on a service account with far more access than the job needs, because that was the fastest way to ship. Warden gives every agent its own workload identity, its own short-lived credentials, and an entitlement set scoped to the data class it is actually cleared for.
- SPIFFE workload identity per agent, per environment
- 15-minute credentials — brokered, never held by the agent
- Data-class clearance — public, internal, confidential, restricted
- Entitlement diffs in code review before an agent ships
| read | write | money | egress | secrets | |
|---|---|---|---|---|---|
| support-bot | ✓ | ✓ | — | hold | — |
| devops-agent | ✓ | hold | — | ✓ | hold |
| finance-agent | ✓ | ✓ | ≤$500 | — | — |
| research-agent | ✓ | — | — | ✓ | — |
| code-agent | ✓ | ✓ | — | ✓ | hold |
⚠ 3 capabilities are held rather than denied — the agent can still ask, a human still decides.
The decision itself is a model inference.
Rules catch the attacks you already thought of. Everything else — a novel injection phrasing, an agent quietly drifting off its normal call path, a payload that looks fine until you read it — needs a model. Warden runs its own, inline, inside a 15ms budget.
4.6B parameters total · continuous batching · one L40S node serves ~2.4M decisions/day
15 milliseconds, or nobody ships it.
A security control that adds a quarter-second to every tool call gets switched off in week two. The entire budget — fetch context, run three models, evaluate policy, sign the audit record — has to fit inside 15ms, which is why the models are small, quantized and batched on GPU rather than called out to a frontier API.
- Self-hosted by design — payloads never leave the tenant boundary
- Quantized and batched — INT8 weights, continuous batching
- Runs in your VPC for customers who cannot send prompts to a vendor
We attack your agents nightly.
Policies rot. A tool gets added, a prompt gets reworded, and a path that was closed last month is open again. Warden runs an adversarial generator against your own agents and policies every night, producing thousands of injection and abuse variants, and tells you which ones got through before someone else finds them.
- 12,400 variants generated per run from your live tool schemas
- Scored against OWASP LLM Top 10 and MITRE ATLAS
- Fails your CI when a regression opens a path that was closed
A compromised agent stops acting like itself.
Long before an agent does something obviously bad, it starts doing something subtly unusual — reaching for a tool it has never used, in an order it has never used it, at a volume it has never reached. Warden learns each agent’s normal call graph and scores the deviation.
- 41 normal call paths learned for support-bot alone
- Per-agent scoring — no shared threshold across workloads
- Escalates to hold when deviation compounds across a session
Hold is the verdict that makes autonomy survivable.
Allow-or-block is a false choice. Most of the actions worth worrying about are ones you would approve if someone just asked — a production scale-up, a large refund, a merge to a protected branch. Warden holds them, routes them to whoever owns that decision, and releases them the moment a human says yes.
- Routed by ownership — on-call, controller, release manager
- Slack, Teams, PagerDuty or the console
- Expires safely — an unapproved hold times out denied
- Signed to the approver — the human is in the audit record
Prove what your agents did — months later.
When a regulator, a customer or your own board asks what the agent did and who let it, “we have logs somewhere” is not an answer. Every Warden decision is written to a hash-chained, signed ledger: the attempt, the verdict, the policy version, the model scores, and the human who approved it.
- Tamper-evident — each record chains to the previous hash
- Replayable — reconstruct any session end to end
- Mapped to NIST AI RMF, EU AI Act Article 12, SOC 2 CC7
- Exportable to your SIEM without losing the chain
Cap what a bad hour can cost you.
Injection is one failure mode. The other is an agent doing exactly what it was told, at machine speed, with a bug. Warden puts hard ceilings on money moved, rows read, records emailed and infrastructure changed — per action, per hour, per agent.
- Spend caps per action and per rolling window
- Row and record limits on reads and exports
- Change budgets for infrastructure mutations
- Kill switch — freeze one agent or every agent in one call
The rest of the control plane
Agent inventory
Finds every agent, tool and MCP server reaching your systems — including the ones nobody registered.
Tool-poisoning defence
Detects MCP servers whose tool descriptions change under you, a known route to silent privilege escalation.
Output moderation
Scores what the agent is about to say or write, not only what it is about to do.
Retrieval provenance
Tags every retrieved chunk with its source and trust level, so injected content is traceable to the document it came from.
Policy as code
Versioned, diffable, testable. Ships through the same pipeline as the rest of your infrastructure.
Simulation mode
Run new policy against yesterday’s real traffic and see exactly what it would have blocked before you enforce it.
Session replay
Step through an agent run call by call, with the model scores and policy evaluation at each step.
Kill switch
Freeze one agent, one tool or the entire fleet from the console or a single API call.
SIEM & SOAR
Streams to Splunk, Sentinel and Chronicle with the decision context attached, not just the verdict.
Runs where your data already lives
The models are small enough to self-host, which matters when the thing being inspected is your customers’ prompts.
Warden Cloud
Managed control plane and inference fleet. Fastest path to a first policy; suitable when prompt content is not itself regulated.
Self-hosted inference
Control plane hosted, guard models run on your own GPUs. Prompts and payloads never cross the tenant boundary.
Fully isolated
Everything on your infrastructure, including policy distribution and the model registry. For defence, health and regulated finance.
Design-partner slots are free through private preview. Team and Enterprise plans are priced per governed agent and per decision volume.
See PricingThe ones we actually get asked
How is this different from an LLM firewall?
Does this slow my agents down?
What happens if Warden goes down?
Do you see our prompts and data?
Which agent frameworks do you support?
Is this available today?
Your agents already have write access.
If an agent in your stack can send an email, move money, merge code or change infrastructure, the interesting question is not whether it will be manipulated — it is what happens the first time it is.