Your own agents hold the keys. Watch the door.

The insider you hired

Trusted agents, real keys.

The risk is not a rogue employee. It is a helpful agent with a live token that does what a prompt, a bug or an attacker tells it to.

• IP exfiltration

  • An agent with repository and shell access can send source, models or data anywhere
  • Solomon limits each agent's network egress to the destinations you allow
  • Model weights, vector stores and system prompts are guarded at the file level

• Credential harvesting

  • Agents run next to cloud keys, SSH keys, kubeconfigs and other agents' tokens
  • Unapproved reads of those files are reported, or refused in the kernel where you enforce
  • Decoy credentials trip a high-severity alert the moment anything opens them

• Lateral escalation

  • A trusted agent can delete a namespace, force-push or change infrastructure
  • Those actions are held until the agent's owner approves them on a phone
  • Unattended agents are frozen in place while they wait, not left running

Capabilities

DLP and AI security for every agent you run.

Controls in the kernel, decisions on a phone and deterministic rules in between.

• Human-in-the-loop (HITL) approvals

  • Destructive Kubernetes, Terraform, force-push and sensitive-file actions held for the agent's owner
  • An approval allows exactly that action, once; anything else is still denied
  • Requests expire to deny, and a built-in “Deny and pause agent” stops it outright

• Data loss prevention (DLP) for agent actions

  • DLP findings, target host and parameters shown before anyone approves
  • Egress allowlists per agent or workload scope, by address or domain
  • AI assets protected: model weights, vector-store data, prompts and LLM configuration

• Secret and token protection

  • Covers AI-agent and MCP credentials, GitHub, Kubernetes, Docker, npm and cloud CLI tokens
  • Browser cookie and saved-login stores included
  • Monitor everywhere, enforce inside the scopes you choose

• Agent discovery and scoping

  • Recognizes Claude Code, Codex, Gemini CLI, Cursor, Copilot, Aider and more when they start
  • Moves each one into its own scope, so its rules follow it and nothing else
  • Registered agents are bound to the person who owns them

• Honeytoken canaries

  • Decoy cloud credentials, SSH keys, kubeconfigs and .env files placed on the host
  • No legitimate program reads them, so they are enforced by default
  • A read is denied and raised as a high-severity alert

• Deterministic guardrails

  • Every action an AI agent proposes passes 10,000+ YARA and Sigma rules
  • Agent identities never count as approvers, and queued remediation needs a second person
  • Every hold, approval and denial is an auditable event

Measured and by design

Every approval¹

single-use grant

to deny a credential-file read in the kernel²

6–34 µs

Deterministic rules³

10,000+

Containment⁴

< 300 µs

1. 1Each approval is a non-replayable grant bound to one action, host, time window and human signature.
2. 2Emulated AI-agent swarm evidence run, 1 Oct 2026: medians, MITRE ATT&CK T1552.001.
3. 3YARA and Sigma rules applied in the Platform's deterministic layer (owner-confirmed, 19 Oct 2026).
4. 4Emulated AI-agent swarm evidence run, 1 Oct 2026: credential-file theft denied in 6–34 µs, process-secret dumps in 15–31 µs, attacker process tree killed in 31–130 µs, IMDS theft in 55–200 µs (medians).

Solomon platform

Which products

• Human in the loopSolomon XGuardThe owner approves or denies each held action on their phone, with a hardware-signed decision.Explore →
• Kernel actsSolomon eBPF ClientScopes each agent, holds its critical actions and blocks secret access and exfiltration in the kernel.Explore →
• AI agents thinkSolomon Agentic AI PlatformRoutes approval requests, scores the risk and enforces deterministic rules and four-eyes approval.Explore →