One runtime. One policy model. One audit trail.
Every tool call, API request and database query your own agents make passes through the Mitrity runtime — validated against the agent's declared mission in real time, before the action executes. Agents that live inside SaaS platforms join the same record through read-only connectors. Here's the whole platform, pillar by pillar.
Decide which agents run — and keep the evidence.
Approvals, compliance posture and an inventory of what your agents use, all built from the same record that governs every action.
Approve every agent before it runs
Two decisions stay with people: whether an agent may run at all, and whether a risky action may proceed. Reviews put what an agent was declared to do beside what it has actually done, and one setting decides whether an unapproved agent may act.
- Lifecycle statuses from proposed to approved, blocked or retired — every change on the audit trail
- Assessments pre-filled from what the agent did in the last 90 days, each answer with its evidence
- Attested reviews with separation of duties, periodic re-review, and a change review whenever a finding or policy drift calls for one
- An approval gate in the runtime that can refuse every action of an agent nobody has approved
Evidence an auditor can verify, not just read
Control libraries cover the EU AI Act, NIST AI RMF, ISO/IEC 42001 and 27001, GDPR, SOC 2, the OWASP LLM Top 10 and MITRE ATLAS. Your posture against each is computed from the records Mitrity holds, control by control, with every gap stated. Reports, evidence bundles and the audit trail beneath them carry the hashes and signatures that show whether anything changed.
- Posture against each library, control by control — covered, partial, not covered or not assessed, never a bare percentage
- An AI risk register with owners and a computed residual beside the declared one, and AI policy statements people attest to
- SOC 2, GDPR, ISO 27001, AI assessment and framework reports with integrity hashes — plus evidence bundles and expiring share links
- A tamper-evident audit trail: every event hash-chained, sealed by signed checkpoints, verifiable offline
You can't govern what you can't list
The AI Bill of Materials is a live inventory of every agent, tool, model, credential and connector in your environment — not a quarterly spreadsheet, but a graph that updates as your fleet does.
- Automatic discovery of agents, tools, credentials and connectors
- Always current — the inventory updates with every governed event
- Spot shadow agents, unused tools and long-lived credentials at a glance
- Models too: the repositories your agents load, scanned, and the hosted models they call, checked against your policies
Defend every action — and test that the defense holds.
Runtime defense in front of your tools and model providers, adversarial tests against your own agents, and scans of the models they load.
A governed front door for every model and tool
A single governed entry point in front of everything your agents talk to, from internal tools to the model providers they call. Instead of scattering permissions across configs, every capability is granted — and revoked — in one place.
- Per-agent, per-tool access control: allowed operations, scopes, and time windows
- Destination allowlists — agents only reach endpoints you've approved
- Rate limits per tool per agent, so even allowed actions can't be abused
- Model calls to Anthropic, OpenAI, Azure OpenAI / AI Foundry, Google Vertex AI, Amazon Bedrock (OpenAI-compatible API) or any OpenAI-compatible host, governed the same way
- Model allowlists, token caps, budgets and rate limits set per policy — enforced before a call reaches the provider
Know what someone could make your agents do
Adversarial campaigns run against your LLM routes and your own agent endpoints, on a schedule. Every attempt goes through the same governance as any other action, and the full exchange stays in your environment.
- Campaigns against LLM routes and your own agent endpoints — dry run by default, with attempt, time, token and spend ceilings
- Every attempt governed and audited; full prompts and responses never leave your environment, only hashes and a redacted excerpt
- Deterministic oracles where the outcome is a fact — and every finding labeled with the confidence of the oracle that decided it
- Findings mapped to OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, the EU AI Act and ISO/IEC 42001, and a guardrail assurance score per agent
Read the model before your agent loads it
A PyTorch checkpoint is a pickle stream, and loading a pickle runs whatever it names. Mitrity reads the repositories your agents load without executing anything, and reports what is in them — with the byte offsets to prove it.
- Pickle streams and PyTorch archives disassembled, never executed — every global they reach, with its byte offset
- safetensors and GGUF header integrity, and hidden instructions in model cards, configs and chat templates
- Remote-code surfaces (auto_map, custom pipelines, shipped Python) and unpinned revisions, flagged
- Hosted models observed at the gateway, checked against your policy rules and a curated list of known-unsafe models
Three layers between attackers and your agents
Prompt injection is the confused-deputy attack of the agent era. Mitrity screens inputs before they land — with defenses that don't depend on having seen the exact trick before.
- Layer 1: pattern matching against known injection signatures
- Layer 2: statistical analysis that flags structurally suspicious inputs
- Layer 3: an ML classifier for novel and obfuscated attempts
- Catches instruction override, system-prompt injection, and encoding evasion
Agents borrow secrets. They never own them.
Pasting a permanent API key into an agent's config is leaving the master key under the doormat. The broker mints just-in-time leases instead — and takes them back the moment behavior drifts.
- Just-in-time credential issuance with short-lived leases
- Automatic revocation the moment behavioral drift is detected
- Credentials never leave your environment — only lease metadata is reported
- No standing secrets means nothing for a compromised agent to steal
When agents hire agents, lineage matters
A compromised low-privilege bot shouldn't be able to weaponize a high-privilege peer. Mitrity tracks every agent-to-agent delegation chain and enforces that privilege can only narrow downstream.
- Full delegation-chain tracking across your multi-agent workflows
- Circular-delegation detection, depth limits, and fan-out thresholds
- Privilege propagation by intersection — a delegate never exceeds its caller
- Blocks AI-to-AI privilege escalation inline, not in a post-mortem
Sensitive data stays where it belongs
Agents touch the most sensitive data in your stack. Mitrity classifies it in flight, redacts or blocks it before it leaves, and stops exfiltration to destinations you never approved.
- In-flight classification: PII, credentials, financial and health data
- Exfiltration blocking to unauthorized destinations
- Accumulation detection stops slow-drip data theft across sessions
- Prompts redacted before they leave your cluster, and model responses before they reach the agent
Every customer's defense sharpens yours
Traditional threat intel is IPs and file hashes. Agent attacks look different — so Mitrity shares behavioral attack signatures across the fleet, without any tenant's data ever leaving its boundary.
- Community-sourced threat indicators, contributed anonymously
- Cross-tenant pattern detection with strict privacy guarantees
- Indicators are universal; matches are always tenant-scoped
- Novel-attack defense that improves with every customer
Reach the agents that live inside your SaaS
Some agents never touch a gateway — they run inside Microsoft 365, Salesforce, GitHub and Snowflake. Mitrity brings AI Security Posture Management (AI-SPM) to those agents: connect each platform with read-only credentials you provision and govern them out-of-band — discover them, observe what they did, assess their security posture, and put them through the same reviews as the rest of your fleet. Nothing is installed in the vendor's cloud.
- GitHub Copilot — discover coding agents, import org audit activity, read security posture
- Microsoft 365 Copilot and Copilot Studio — the tenant's Copilot, published agents and every Copilot Studio agent, posture-checked read-only
- Salesforce Agentforce — Agentforce agents, setup-audit telemetry and org posture proxies
- Snowflake Cortex Agents — discover Cortex Agents, import AI-observability activity, read account security posture
- Read-only AI-SPM: Discover · Observe · Posture — Pro and Enterprise; nothing to install
Intent-aware governance — the layer every pillar stands on.
Not just what an agent does — whether it fits the mission. Every action is scored for drift, risk and anomaly by ML that runs where your agents run.
Enforcement that fits how your team works.
Monitor → Alert → Enforce
Graduate at your own pace, per agent. Start observing, move to alerts, then let Mitrity block — with fail-open or fail-closed defaults you choose.
Approvals in Slack
Suspicious actions are held for a human with interactive approve/deny buttons and full context. Configurable timeouts — the agent is never stuck forever.
Native SIEM forwarding
Every governance event streams to Splunk (HEC), syslog CEF, or any webhook. Your SOC keeps its single pane — Mitrity just fills it with better signal.
The whole platform, on your agents, in five minutes.
Start with the pillars you need today. Turn on the rest as your fleet grows — same missions, same verdicts, same audit trail.