Book a demo

Platform

Security fabricWhat Kronos securesAI factory lifecycleSources and integrationsRed teaming

Solutions

Model supply chainData ingestion and encrypted retrievalPrompts, APIs and agentsObservability and auditAgents and MCP gateways In development

Compliance

OWASP Top 10International standardsMiddle East and North AfricaAudit evidence

Company

About usContact us
Book a demo

Prompts & agents

Prompts, APIs and agents

Every prompt is a policy decision before it is a model call, and every agent action is checked against what that agent is allowed to do. User input, API traffic and autonomous actions pass the same checks, and the answer can be no.

Book a demo

15 gates · each one fails closed · every decision written to the audit band

Prompts and APIs

  1. Input

    Prompts, API calls, agent actions

    The entry point for chat, service-to-service API traffic and tool calls made by agents. Identity, tenant and session attach to the request here.

    Inputingress.prompt session=8f31 channel=api tokens_in=612 agent_tools=3

  2. Encrypt in transit

    Ciphertext before it leaves the client

    mTLS protects the channel, and envelope encryption under your keys protects the content inside it. A gateway operator or proxy sees ciphertext, not the question and not the answer.

    Encrypt in transitencrypt.prompt tls=mTLS1.3 envelope=cmk/prompts operator_visibility=none

  3. Policy check

    Who may ask what, of which model

    Authorization before inspection: tenant scope, model entitlement, data classification and rate limits. A call that fails here never reaches a GPU.

    Policy checkopa.eval policy=kronos.prompt.v2 tenant=ok scope=ok rate=ok continue

  4. Guardrails

    Injection, jailbreak and topic rails

    Injection and jailbreak classifiers run on the way in, and output filters on the way back. Content, model and prompt safety are separate rails with separate thresholds.

    Guardrailsnemo.guard prompt_injection=0.94 jailbreak=0.88 BLOCK

  5. Red teaming

    Garak runs against you, continuously

    Scheduled adversarial suites run against live endpoints: persona jailbreaks, encoding smuggling, poisoning and leakage probes. Findings feed straight back into the guardrail rules.

    Red teaminggarak.probe suite=dan,encoding,leakage runs=1,240 new_findings=2

  6. Runtime controls

    Limits on what the model may do next

    Tool-call allow-lists, context isolation between tenants, token and cost ceilings, and output filters for secrets and PII. This is the containment layer for agentic systems.

    Runtime controlsruntime.ctl tool_calls=deny:file_read ctx_isolation=on filter=pii,secrets

  7. Response

    Allow or block, and say why

    The decision comes back with a reason code, encrypted on the return leg. The caller gets a safe refusal instead of a leak, and the record is written to the audit band before the connection closes.

    Responseresponse.emit verdict=BLOCK reason=prompt_injection audit=written

Agents

  1. Build

    Trust what goes into the agent

    Static analysis, dependency and secret scanning and an SBOM across the whole agent package, with provenance checked on every dependency it pulls in.

    Buildbuild.scan sast_high=0 deps=284 secrets=0 sbom=generated provenance=verified

  2. Verify

    Skills and MCP servers are untrusted software

    Skills are inspected for malicious instructions and injection payloads. MCP servers are checked for identity, authentication and dangerous tool exposure. Reachable is not approved.

    Verifyverify.skills inspected=7 injection_findings=1 REJECTED mcp=3 tools=19

  3. Register

    A trusted agent registry

    Only agents that clear the gates are stored, with their version, SBOM, MCP and skill inventory, scan results, signature and provenance. The registry decides what may be deployed.

    Registerregistry.put agent/case-corr:3.1 signed=true mcp=3 skills=7 state=approved

  4. Identity

    SPIFFE and SPIRE workload identity

    Approval proves the artifact is trustworthy. It doesn't prove the running workload is that artifact. SPIRE attests the workload and issues an SVID for mutual TLS.

    Identityspire.attest spiffe://kronos/agent/case-corr svid=x509 ttl=1h mtls=enforced

  5. Policy

    What this workload may do

    Identity answers who; policy answers what. Allowed tools, models, data classes and network destinations bind to the agent's identity, not to the environment it runs in.

    Policyopa.bind agent=case-corr tools=allow:3 models=allow:1 egress=deny all

  6. Isolate

    A sandboxed execution boundary

    Each agent runs in a sandbox with a controlled filesystem, network and runtime. Policy is enforced at that boundary, so an agent that misbehaves has a bounded blast radius.

    Isolatesandbox.start fs=ro+scratch net=egress_proxy exec=restricted blast=contained

  7. Access

    Mediated tools, models and memory

    No direct access to enterprise resources. MCP servers for tools, an inference gateway for models and governed RAG for knowledge, each checked against the agent's identity per task.

    Accessaccess.mediate tool_calls=142 denied=3 inference=gateway rag=scoped:case_kb

  8. Audit

    What it tried, and what it touched

    Tool and MCP activity, inference calls, access events and policy violations feed the same audit and incident chain as every other band.

    Auditaudit.agent traces=1,204 tool_calls=142 violations=3 alerts → incident

The rest of the fabric

Back to the full fabricBook a demo