An agent can turn a plausible instruction into a consequential tool call, export, command, workflow change, or external message. Without an independent control point, the organization may discover the mistake only after the action has executed.
MAX-PRO portfolio
AI-agent runtime control
MAX-AI Guard
Put a deterministic policy decision between an AI agent and the action it wants to take.
Best forAI-agent platform, security, operations, and compliance teams
Workflow stageAI-agent runtime control
DeliversAllow, deny, approval, redact, or quarantine evaluation · Matched-policy explanation
Current maturityPilot
The job to be done
Why this product exists.
The public pilot demonstrates deterministic pre-action evaluation, policy matches, approval paths, safer alternatives, receipts, and the SDK pattern an agent must call before a tool executes. Signed single-use execution grants are implemented behind a fail-closed production gate, but live grant issuance remains disabled until isolated production identities and a durable replay store are explicitly activated.
How it works
One controlled path through the handoff.
- 01
Propose
The agent submits the intended tool call, actor, resource, data context, and purpose before execution.
- 02
Evaluate
Guard applies deterministic rules and returns a machine-readable decision with reasons and required controls.
- 03
Enforce and record
An integrated caller—not the dashboard—must verify the authorization, execute only the returned canonical request, and retain the receipt.
Concrete example
What the workflow looks like in practice.
An outreach agent attempts to email an external recipient with sensitive client information. Guard matches the data-handling and external-communication policies, requires human approval or returns a redacted alternative, and records the final decision before the message can be sent.
Inputs and outputs
What goes in. What comes out.
Inputs and context
- Proposed tool or API action
- Agent, user, and organization identity
- Resource and destination context
- Data classification and applicable policies
Resulting record
- Allow, deny, approval, redact, or quarantine evaluation
- Matched-policy explanation
- Approval route and safer alternative
- Machine-readable decision payload
- Receipt and evidence-hash record
Where it fits
Distinct role. Clear handoff.
MAX-AI Guard is the immediate pre-action control pattern for an integrated agent. Defendry is the broader RiskOps system for cases, owners, remediation, verification, and closure. A verified Guard receipt can be referenced as evidence inside a Defendry case.
Current boundaries
What this product is not.
These limits are part of the product decision. They are shown before the launch link so the current scope is clear.
- Guard must be integrated into the agent’s execution path; a dashboard alone cannot stop an external tool or API call.
- The current public deployment is a demo/pilot control plane. Production execution-grant issuance is disabled and fails closed until non-demo identities and durable one-time replay protection are configured and accepted.
- It is not a general vulnerability scanner, SIEM, endpoint security agent, or organization-wide GRC platform.
- Policy-as-code, replay simulation, least-privilege recommendations, SIEM exports, and a broad compliance dashboard remain roadmap capabilities until they are deployed and verified.
Ready to evaluate it?
Explore the pilot or discuss an integration.
The product opens on a separate MAX-PRO deployment in a new tab.
Continue exploring