Every consequential action your agent takes — a refund, a payout-record change, an outbound message — is designed to route through one chokepoint, and we prove the set is complete before you rely on it. The gate checks typed facts (amount > limit, approval_verified == false) and never the agent's words.
Everyone is shipping prompt-injection detectors. But a detector that's 99% accurate still flips the attacker's coin — a few hundred free retries and one payload gets through. You cannot win a retry war with a filter, and the filters are commoditizing into the cloud platforms' free tiers anyway.
So stop trying to keep the agent un-fooled. Assume it will be fooled — then put a deterministic gate in front of the action it would take. The gate never reads the agent's words, so there is nothing to jailbreak. A perfect prompt injection buys the attacker nothing.
In late 2025, Palo Alto Networks' Unit 42 found indirect prompt injection actively weaponized across the public web — 22 distinct techniques on real sites, hijacking AI agents into triggering Stripe payments, deleting databases, and approving scam ads. One scam page stacked 24 separate injection attempts.
Notice what the damage actually was: not "the agent read a bad sentence" — a payment moved, a record was destroyed. That's an action. Guard the action and the injection is inert, no matter how clever the sentence that triggered it.
A jailbreak wins by changing what the agent believes. None of these three can be moved by anything the agent believes, says, or is told.
Every rule is a pure function of structured facts — amount_cents > limit, approval_verified == false, payout_changed_recently. There is no natural-language understanding to fool, so a perfect jailbreak buys nothing.
The guarantee is completeness: no consequential action reaches the outside world except through the gate. A documented chokepoint contract plus a CI drift-check fails the build the day a new tool slips a side door.
Default mode logs the decision it would make and lets the action proceed — into a hash-chained, tamper-evident evidence log. You see exactly what it would have stopped on your real traffic before you let it stop anything.
The live demo runs the real engine in your browser — no server, no model. Pick a scripted attack (refund abuse, payout laundering) or build your own action and type the most persuasive jailbreak you can. The verdict won't move, because the gate never reads your words. There's also a one-click chokepoint check: paste your agent's tool list and see which actions would be gated and which are side doors.
A detector asks "is this input malicious?" — an infinite question, and the attacker gets unlimited tries. The gate asks "is this action allowed?" — a finite, typed one. Finite is ownable.
Detection and containment aren't competitors — a detector that quietly drops obvious junk is fine. But it can't be the thing standing between a compromised agent and your money. For that you need a wall that doesn't negotiate, and a wall that doesn't read can't be talked around.
Anyone can write a refund-limit rule, and the incumbents will. What's hard — and what compounds — is proving that every consequential action routes through the gate, with no side door, and keeping it that way as the agent gains tools. That proof is the product.
A documented contract lists every gated action, and a CI check fails the build the day a tool is added without a gated path. Coverage can't silently rot — a guarantee you can't quietly break is one you can actually sell.
Before the guarantee applies, we enumerate every tool your agent has and prove there's no ungated path. If it has a raw shell or arbitrary query, the chokepoint can't be complete — and we say so, instead of selling you a wall with a door in it.
Two tiers. The first earns the meeting; the second proves it on your own traffic. Nothing gets blocked until you've seen what would have been blocked.
The real engine, in your browser, against a mock agent. It shows the mechanism is deterministic — a jailbroken agent gets the same answer as a fooled one. Open it →
We wire the gate in front of your real agent in shadow mode for 10–14 days. It blocks nothing; you keep the evidence report — "here's the catastrophic thing we'd have stopped." See the pilot checklist →
We don't harden the agent or stop every jailbreak — we assume the agent will be fooled. We guard a finite, typed set of consequential actions, completely, and we prove the set is complete.
We don't guard actions you don't route through the gate. If your agent has a raw shell or an arbitrary query tool, the chokepoint can't be complete — and we'll tell you that before we sell you anything.
For everything else, you need other tools. We'll tell you which ones.
Two weeks, blocks nothing, and you keep the evidence report either way. If it never would have stopped anything, you've lost nothing but the wiring time.
Book a shadow-mode pilot →