From agent to dashboard, in five steps
Kernel signals reach the endpoint, the local policy bundle decides within 100ms, and content is never opened.
The endpoint receives the policy bundle
The endpoint pulls the bundle from the policy server and stores it locally. From then on it monitors OS kernel signals.
The agent reads a file or calls a tool
File reads and tool calls by the AI agent reach the endpoint as OS kernel signals. No content decryption, no MITM certificate.
Local policy allows or blocks instantly
The locally stored bundle decides within 100ms. On a violation, the agent's execution is blocked. The same holds when the policy server is down.
activity, tool_call and decision events are sent
Behavior events, tool calls and policy decisions are shipped to the dashboard.
Logs are stored, behavior is visible
Review policy decisions and behavior events on the dashboard, adjust policies, and approve or deny.
Pick an action and run it yourself
Kernel signal, policy match and enforcement all finish inside the endpoint. Only then do events go to the dashboard.
- 01Policy bundle
- 02Kernel signal
- 03Local decision
- 04Events
- 05Dashboard
Agent action
Kernel signal
Policy match
Enforcement
- Matched policy
- Verdict
- Idle
Run an action and its events go to the dashboard
Activity events
ReadyChoose an action and run it to see its timeline here.
Frequently asked questions
No. Behavior is decided from OS kernel signals. No MITM certificate is installed and content is never opened.