AI agent execution security

Products in this solution

• Chrysent Bastion

  Chrysent Bastion protects enterprise systems from unsafe AI generated actions.

  Private beta

• Chrysent Touchstone

  Chrysent Touchstone focuses on protecting AI systems from malicious or unsafe interactions.

  Private beta

• Chrysent AI Gateway

  Chrysent AI Gateway provides centralized control over AI usage across multiple vendors and models.

  Private beta

Problem

AI agents are being granted access to tools, local machines, MCP servers, and production systems. Without a boundary, a single misconfigured agent can take destructive actions before anyone notices. Documented incidents in 2024–2026 include: Claude Code ran an unrecoverable `rm -rf ~/` against an engineer's home directory; Cursor deleted a developer database in 9 seconds; Replit's coding agent wiped a production-style database during an autonomous session; `terraform destroy` incidents caused by coding agents executing destructive cloud operations against live environments.

Stakeholders

CISO and security teams, engineering leadership, platform engineering, government and regulated procurement. The same controls answer “how do we audit what the agent did?” for legal and compliance stakeholders.

Architecture

Bastion is configured as a pre-tool-execution hook in the agent harness. Its customizable policy engine evaluates every proposed tool call and returns allow, deny, or human-review decisions. The harness executes only allowed calls; Bastion never executes tools. Denied calls return stable codes such as category-scoped filesystem, container, Terraform, cloud, SQL, or source-control diagnostics. Decisions are recorded with the call's context, the rule that fired, and an explanation when transparency helps — or a concealed reason when revealing policy would help an attacker. Bastion routes its decisions through Gateway so the session ledger and the audit surface are unified. Decisions carry the version set of every component that participated (Gateway, Touchstone, Bastion), the rule identifier that fired, and the cryptographic chain position. Failures produce an explicit “unavailable” or “incomplete” result rather than “allow”; a pre-authorized tenant disposition may release selected low-risk work under fail-open while failing closed for sensitive workloads.

Outcomes

Pre-execution policy decisions with policy-as-code; transparent decision trace; protected paths and dangerous-command detection; audit-ready decision log; explainable rejections without leaking policy details; immutable session ledger integrated with the rest of the control plane.

Proof

The first public benchmark for Bastion unsafe-action detection is in preparation. Until then, design partners receive the methodology and a private run report under NDA.

Deployment

Bastion is self-hosted software that runs in customer-owned or customer-controlled infrastructure, and retained product data remains there. Customer-configured external model providers receive provider-bound request data under the customer's provider agreement. This model supports data sovereignty and residency requirements. Air-gap-capable deployment is a future direction.

FAQs

See Bastion and Touchstone product pages for product-level FAQs.