Targets and access.
Agree which systems, repositories, accounts, and materials are in scope. Permissions should follow the task and be revocable.
SECURITY PRINCIPLES / BOUNDARIES BEFORE AUTONOMYDefine the boundary.
Define the boundary.
Keep the control.
Agentic security starts with the agent’s own permissions. These are the boundaries and review principles we’re designing around as the products develop.
THE INVESTIGATION MODELCONCEPT / 3D
CONTEXT INEVIDENCE OUTPURPOSE-BUILT SECURITY AGENT.DRAG TO INSPECT
Permission should
be explicit.
We’re designing agents around a defined target, permitted actions, and reviewable evidence. The boundary should be understandable before the investigation starts.
ANIMATED 3D WORKFLOW / CONCEPT
Conceptual permission flow. Product-specific controls and approval mechanisms remain in development.
Actions and approvals.
Separate investigation from changes that affect systems or people. A proposed fix should remain a proposal until the appropriate owner approves it.
Evidence and uncertainty.
Make observations, sources, and unresolved assumptions visible. Teams need a way to challenge a finding and repeat the relevant check.
Data and lifecycle.
Define what data a workflow needs and how access, storage, retention, and deletion should work before connecting sensitive environments.
03 / BEFORE A PILOTQuestions to
Questions to
settle first.
These details depend on the product and are still being defined. They belong in the conversation before an environment is connected.
- Which permissions does the agent need?
- Where would the supplied data be processed and stored?
- Which external services or models would be involved?
- How would retention, deletion, and access revocation work?
- Which actions require review, and who can approve them?
- What evidence would demonstrate the workflow is working?
Contact starts in your email app.
The form prepares an email draft. It does not connect to your systems or upload files. Begin with a description of your use case.
Your theme stays in this browser.
The light or dark preference is stored locally. Text fonts load from Google Fonts; the custom logo is included directly in the page.
No live scanning here.
The models and examples explain product direction. They do not inspect your environment or represent results from a running security agent.