Make untrusted data structurally unable to trigger a sensitive action — taint / information-flow control + policy at the tool-call boundary, a deterministic guarantee, not a guess. The same system is your system of record for every non-human identity: what it is, what it can do, what credentials it holds, and what it did. Drop-in for Claude Code, Cursor, Copilot, Devin, CI & MCP.
Agents ingest untrusted input — a web page, a file, a ticket, another tool's output — then execute with real credentials. Prompt injection & agent hijacking is the #1 agentic risk (OWASP ASI01, 2026), and a text filter has to recognize the attack to stop it.
Poisoned files, tickets, web pages & tool responses override the agent's task — Agentjacking hijacked Claude Code / Cursor via a Sentry→MCP path.
A hijacked agent reads .env / creds and posts them to an attacker host — the Clinejection pattern that hit thousands of dev machines in 2026.
An over-privileged agent runs with full blast radius — delete prod, move money, chain tools — with no step-up and no audit trail.
An open-source core (engine + gateway + Python/TS SDKs, Apache-2.0) plus a managed control plane. Twelve MVP screens map the lifecycle end-to-end: Connections · Discovery · Inventory · Identity · Access (CIEM) · Grants · Policy · Approvals · Decisions · ITDR · Audit · Settings — the customer-owned data plane runs in your VPC, the Xtrom-managed control plane keeps the record.
Deterministic taint / Information-Flow Control makes untrusted data structurally unable to parameterize a sensitive action. Shipped policy rules: least-privilege capabilities, prod-destructive step-up, secret-egress allowlist, human approvals, taint/IFC.
Secretless connectors (AWS, GitHub, Vault, MCP, IdP, agent frameworks) plus discovery of every governed & ungoverned agent identity across them.
Every agent + live posture + credential history. The standing_secrets == 0 invariant is enforced at ingest.
Granted-vs-used right-sizing plus short-lived, scoped credentials with live countdown and revoke-now — pluggable JIT backends (STS, Vault, GCP-WI, Azure-MI).
Signed, KMS-verified, versioned entitlement bundles. Every decision is stamped with its policy_version; stale-cache = fail-closed.
ALLOW / STEP-UP / BLOCK stream with layer + stable reason_code. Behavioral ITDR flags identity-compromise; quarantine, rotate, revoke from the same screen.
Human step-up queue with silence-is-DENY SLA. Actor-attributed WORM audit trail with CSV / SIEM export. Global admin kill-switch, fail-safe.
Engine, gateway, policy, JIT and SDKs are Apache-2.0 open source. The commercial control plane hosts the system-of-record, cross-fleet detection corpus, and console.
Every screen belongs to exactly one stage of this lifecycle — the mental model we sell, demo, and build to. Start in monitor-mode; enforce when you're ready.
Secretless connectors to AWS, GitHub, Vault, MCP, IdP.
Every agent — governed & ungoverned — inventoried.
Right-size entitlements; JIT credentials; policy bundles.
Deterministic taint/IFC + policy at every tool call.
Live decision stream + behavioral ITDR baselines.
Approve, step-up, quarantine, rotate, revoke — now.
WORM audit, policy-versioned, export to your SIEM.
Model guardrails are probabilistic filters that get talked around. We enforce deterministically — and we're neutral across every model and cloud.
On a mixed agent-attack corpus, deterministic enforcement contains every attack — including the low-signal ones a text classifier scores as harmless. Reproducible with our open benchmark harness.
| Attack | Detector score | Guardrail-only | Xtrom | Deterministic layer |
|---|---|---|---|---|
| indirect-injection exfil | 0.13 | ALLOW ✗ | BLOCK ✓ | L3 · taint/IFC |
| secret egress | 0.20 | ALLOW ✗ | BLOCK ✓ | L3 · secret-egress |
| out-of-scope tool call | 0.07 | ALLOW ✗ | BLOCK ✓ | L4 · scope |
| destructive prod action | 0.04 | ALLOW ✗ | STEP-UP ✓ | L4 · policy |
| blatant injection (both catch — honest overlap) | 0.90 | BLOCK ✓ | BLOCK ✓ | L3 · taint/IFC |
We don't hide the overlap: blatant attacks are caught by both. The edge is the low-signal attacks that actually get through — decided on data provenance and capability, not on how malicious the text looks.
We're a security company — we hold ourselves to the standard we sell. Your agents and data stay in your environment.
Data plane runs on your Kubernetes on any cloud (EKS/AKS/GKE). Prompts, secrets, and data never leave your environment.
Signed, versioned entitlement bundles (KMS RSASSA_PSS); per-tenant HMAC PII pseudonymization on external log paths.
Every decision is written to S3 Object-Lock (COMPLIANCE mode) — the evidence your auditors and the EU AI Act require.
A small first cohort of charter partners — free 60-day pilot, live in under a day, monitor-mode first so nothing breaks.