Where your data lives, what leaves it, which keys exist and where a request may reach — and the ten agentic risks your auditors arrive with, each answered with the mechanism that enforces it.
Where the data sits, what crosses a boundary, which keys exist and where a request may reach. Each answer names the mechanism that enforces it, so it can be checked rather than taken on trust.
DATApostgres · qdrant · object storage
Where the data lives
Tenant rows sit in Postgres with row-level security forced on — the hosted platform’s, or your own when it runs in your estate — so a query that forgets its tenant returns nothing rather than everything. Vectors sit in Qdrant and files in S3-compatible storage, resolved per tenant: a company that registers its own store has its artifacts written there and never into the platform’s.
Isolated per tenant, wherever it runs
EGRESSa2a-model-gateway-api
What leaves it
A model call is the one place tenant text crosses a boundary, and what crosses is decided by the exposure mode the caller asked for and the policy that caps it. A notification carries event metadata — type, resource, tenant, correlation, timestamps — and never the payload, because a receiver can query the platform with its own credential instead.
Egress is a policy decision
CREDENTIALSa2a-secrets
Which keys are held
The database holds the path to a secret and the time it was last rotated, not the secret. Each tenant’s provider credential resolves at call time — from its own path in the platform’s vault, or from the tenant’s own vault once it registers one — and a tenant that has asked to fail closed is refused rather than served the platform’s key by accident.
A path, never the secret
IDENTITYa2a-auth
Who a caller is
Tokens are verified against the identity provider’s published keys — the platform’s, or yours in your own estate. Permissions are never read from the token — they are resolved from the directory and the platform’s own tables — and a credential that tries to assert its own permissions is refused rather than ignored. A delegated credential names both the person and the service acting for them, and refuses to be forwarded a second time.
Permissions are resolved, not asserted
NETWORKa2a-tool-gateway
Where a request may reach
An outbound target is resolved, checked and then pinned to the one address that was validated, so a hostname cannot answer publicly for the check and privately for the call. Loopback, private ranges and link-local — including the cloud metadata address every SSRF write-up ends at — are refused, in every notation they can be written in.
One validated address, pinned
RETENTIONartifact_retention_sweep_interval_ms
What survives deletion
Retention is a governed profile rather than a script: bytes are deleted before the row that points at them, every removal records an event, and an active legal hold blocks the sweep exactly as it blocks a person. Evidence can be exported per tenant, so leaving with your records is an ordinary operation.
Holds outrank retention
What is deliberately not claimed: no certification. SOC 2, ISO 27001 and HIPAA describe an organisation and how it operates, not a property of a binary — and a vendor badge on this page would not tell you anything about your deployment. What the platform provides is the material an assessor asks for: a per-tenant hash chain with signed anchors, an export of it, policy and approval history, and a record of every cross-tenant read with the reason it was opened.
WASMBounded Sandbox Primitive
The Rust WebAssembly sandbox gives a module nothing that reaches the host — it cannot open a host file or resolve a hostname, because the only system it sees is one the platform answers from memory. Bounded by fuel (instructions executed), a memory ceiling and a wall clock, so two runs of the same code cost the same and a replay means something. These limits cover modules run through that sandbox.
POLICY-LEDExplicit Data Exposure
A caller asks for an exposure mode and policy caps it: masked, blind — where free text becomes an opaque reference — or raw where the tenant's policy permits it. Detector coverage, model-provider retention settings and your own classification still matter; exposure control is a boundary, not a compliance certificate.
SHA-256Tamper-Evident Records
Audit events are appended in the same database transaction as the change they record — both commit or neither does — hash-chained per tenant with length-prefixed digests, and periodically anchored with an Ed25519 signature. Integrity helps detect alteration; it does not prove a business result correct.
SCOPED ACCESSIdentity Before Execution
Caller identity, tenant scope, assigned capabilities and resolved permissions decide access, and tenant separation is enforced by row-level security in the database rather than only in application code. A credential that tries to assert its own permissions is refused, not ignored. Proposing a tool call grants an agent nothing.
THE LIST YOUR AUDITORS ARRIVE WITH
Ten agentic risks. Answered one at a time.
OWASP published its Top 10 for Agentic Applications in December 2025. It is the shape the security conversation now takes, so here is the platform against all ten — including where the honest answer is narrower than the headline.
ASI01tool intent preflight
Agent goal hijack
Redirecting the plan does not widen what the plan may do. A model proposes an intent; the platform checks it against what the CALLER is permitted to do, and a hijacked goal still cannot exceed the person it acts for. The lineage that carries delegation depth and budget can only be written by the runtime’s own credential — a caller who forges one is refused by name.
The plan cannot grant itself authority
ASI02a2a-tool-gateway-api
Tool misuse
An agent reaches only the tools assigned to its profile, and each call is authorised before dispatch rather than after. Tools declare what they change — read, suggest, write, destructive — and that level is what decides whether a human is asked, so a tool cannot quietly be used at a higher blast radius than it was assigned at.
Authority is checked before dispatch
ASI03a2a-auth · delegation
Identity & privilege abuse
Permissions are resolved from the directory and the platform’s tables, never read from a token; a credential asserting its own permissions is refused. A delegated credential names the person and the service acting, and must say it refuses forwarding — so it cannot be replayed onward as somebody else. Tenant separation is enforced in the database, forced on even for the owner role.
No credential grants itself anything
ASI04mcp recertification
Agentic supply chain
A tool server is registered, certified before it can be assigned, and re-certified on a governed schedule rather than trusted forever. Connector versions are immutable once they leave draft, so what was reviewed is what runs. The services themselves ship as single binaries with no interpreter and no package tree to drift underneath them.
What was reviewed is what runs
ASI05a2a-sandbox
Unexpected code execution
Generated code runs in a WebAssembly sandbox with nothing that reaches the host: it cannot open a host file, resolve a hostname or read the host’s environment, because the only system it sees is one the platform answers from memory. It is bounded by instructions executed, a memory ceiling and a wall clock. This is the enforcement core — the limits cover what is run through it.
No host reach exists to deny
ASI06memory_expiry_sweep_interval_ms
Memory & context poisoning
Retrieval is scoped by the same row-level rules as everything else, so one tenant’s memory cannot surface in another’s context. Entries carry an expiry and a governed sweep enforces it — the vector is pruned before the row, so a search can never answer from an embedding whose record has gone.
Context is scoped and it expires
ASI07service credentials
Insecure inter-agent messages
Every hop between services carries a signed, short-lived credential with an audience, verified at the far end — nothing is trusted because it arrived from inside the network. Forwarded identity headers are not honoured, and a credential already acting for a person refuses to be delegated again, which is what stops a chain from laundering authority.
Every hop is verified, not assumed
ASI08budgets · breakers · deadlines
Cascading failures
An agent loop is bounded by iterations and time, and the reason it stopped is recorded either way. Calls to a service that has started failing are cut off by a per-upstream breaker rather than piling up. A transaction whose database goes silent is abandoned at a deadline instead of holding a connection for ever, and a run stuck past its threshold raises exactly one incident.
Everything has an end it can reach
ASI09a2a-governance-api
Human-agent trust exploitation
An approval arrives with what would change and what depends on it, and expires rather than sitting forever. Refusing is an ordinary recorded outcome, not an error someone has to justify. Separation of duties means a requester cannot satisfy their own quorum — and a gate nobody can ever clear says so, instead of looking like a colleague who has not replied yet.
A decision, not a rubber stamp
ASI10profile snapshots · assurance
Rogue agents
What runs is the published snapshot of an agent profile, not an editable row someone changed this morning. Completed work is scored and drift is raised for a human rather than repaired silently. An entitlement that lapses suspends the tenant, a binding can be revoked, and every action an agent took is on the tenant’s hash-chained ledger with the person it acted for.
Behaviour is versioned and watched
Read this as a self-assessment. Mapping controls to a public list is a claim the vendor makes; nobody has certified it. The useful version of this conversation is the one where your own team takes a category — ASI02 tool misuse is a good first — and tries to get past it in a deployment you control.
BUILD WITH INTENTION
Give intelligence a responsible next step.
Start a workspace in a minute, or bring a real enterprise use case and we will map the agents, the integrations, the approval roles, and the people who stay in control.