Deterministic action gate. ·No model in the enforcement path ·Hash-chained, tamper-evident evidence log ·Shadow mode by default
Action-containment gate · for AI agents that move money or data

Your AI agent can be jailbroken. The gate in front of it cannot be talked out of a rule — because it reads facts, not sentences.

Every consequential action your agent takes — a refund, a payout-record change, an outbound message — is designed to route through one chokepoint, and we prove the set is complete before you rely on it. The gate checks typed facts (amount > limit, approval_verified == false) and never the agent's words.

Deterministic — no model in the path Shadow mode by default Evidence-first: see what it would stop before it stops anything

Detection loses. Containment holds.

Everyone is shipping prompt-injection detectors. But a detector that's 99% accurate still flips the attacker's coin — a few hundred free retries and one payload gets through. You cannot win a retry war with a filter, and the filters are commoditizing into the cloud platforms' free tiers anyway.

So stop trying to keep the agent un-fooled. Assume it will be fooled — then put a deterministic gate in front of the action it would take. The gate never reads the agent's words, so there is nothing to jailbreak. A perfect prompt injection buys the attacker nothing.

The agent will be fooled. It's already happening.

In late 2025, Palo Alto Networks' Unit 42 found indirect prompt injection actively weaponized across the public web — 22 distinct techniques on real sites, hijacking AI agents into triggering Stripe payments, deleting databases, and approving scam ads. One scam page stacked 24 separate injection attempts.

Notice what the damage actually was: not "the agent read a bad sentence" — a payment moved, a record was destroyed. That's an action. Guard the action and the injection is inert, no matter how clever the sentence that triggered it.

Source: Palo Alto Networks Unit 42, “Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild” (2025).

Three properties, and why each one is load-bearing.

A jailbreak wins by changing what the agent believes. None of these three can be moved by anything the agent believes, says, or is told.

01 / FACTS, NOT SENTENCES

It checks typed facts

Every rule is a pure function of structured facts — amount_cents > limit, approval_verified == false, payout_changed_recently. There is no natural-language understanding to fool, so a perfect jailbreak buys nothing.

02 / ONE CHOKEPOINT

Every action routes through it

The guarantee is completeness: no consequential action reaches the outside world except through the gate. A documented chokepoint contract plus a CI drift-check fails the build the day a new tool slips a side door.

03 / SHADOW FIRST

It watches before it blocks

Default mode logs the decision it would make and lets the action proceed — into a hash-chained, tamper-evident evidence log. You see exactly what it would have stopped on your real traffic before you let it stop anything.

Try to talk it into a fraudulent refund. You can't.

The live demo runs the real engine in your browser — no server, no model. Pick a scripted attack (refund abuse, payout laundering) or build your own action and type the most persuasive jailbreak you can. The verdict won't move, because the gate never reads your words. There's also a one-click chokepoint check: paste your agent's tool list and see which actions would be gated and which are side doors.

Detection asks the wrong question.

A detector asks "is this input malicious?" — an infinite question, and the attacker gets unlimited tries. The gate asks "is this action allowed?" — a finite, typed one. Finite is ownable.

Detection · what everyone ships

Probabilistic filter

  • Guards sentences — an infinite input space
  • Loses the retry war: 99% still flips the coin
  • Breaks the moment the attack is reworded
  • Commoditizing into cloud platforms' free tiers
  • An LLM in the path — itself jailbreakable
Containment · EverHarden Gate

Deterministic chokepoint

  • Guards typed facts — a finite, bounded set
  • Retries don't help: facts don't lie
  • Wording is irrelevant — it's never read
  • Holds even if the agent is fully jailbroken
  • No model in the enforcement path (CI-asserted)

Detection and containment aren't competitors — a detector that quietly drops obvious junk is fine. But it can't be the thing standing between a compromised agent and your money. For that you need a wall that doesn't negotiate, and a wall that doesn't read can't be talked around.

The rules aren't the moat. The complete chokepoint is.

Anyone can write a refund-limit rule, and the incumbents will. What's hard — and what compounds — is proving that every consequential action routes through the gate, with no side door, and keeping it that way as the agent gains tools. That proof is the product.

THE WALL

CHOKEPOINT.md + CI drift-check

A documented contract lists every gated action, and a CI check fails the build the day a tool is added without a gated path. Coverage can't silently rot — a guarantee you can't quietly break is one you can actually sell.

PER CUSTOMER

Phase 0 before any promise

Before the guarantee applies, we enumerate every tool your agent has and prove there's no ungated path. If it has a raw shell or arbitrary query, the chokepoint can't be complete — and we say so, instead of selling you a wall with a door in it.

How an engagement works

Two tiers. The first earns the meeting; the second proves it on your own traffic. Nothing gets blocked until you've seen what would have been blocked.

TIER 1 · DEMO

The conviction demo

The real engine, in your browser, against a mock agent. It shows the mechanism is deterministic — a jailbroken agent gets the same answer as a fooled one. Open it →

TIER 2 · PILOT

Shadow mode on your agent

We wire the gate in front of your real agent in shadow mode for 10–14 days. It blocks nothing; you keep the evidence report — "here's the catastrophic thing we'd have stopped." See the pilot checklist →

What EverHarden doesn't claim

We don't harden the agent or stop every jailbreak — we assume the agent will be fooled. We guard a finite, typed set of consequential actions, completely, and we prove the set is complete.

We don't guard actions you don't route through the gate. If your agent has a raw shell or an arbitrary query tool, the chokepoint can't be complete — and we'll tell you that before we sell you anything.

For everything else, you need other tools. We'll tell you which ones.

Run it in shadow mode against your agent.

Two weeks, blocks nothing, and you keep the evidence report either way. If it never would have stopped anything, you've lost nothing but the wiring time.

Book a shadow-mode pilot →
Deterministic · evidence-first · you see what it would stop before it stops anything