Independent controls and evidence for AI agent operations
Behavry: AI agent governance and verified autonomy
Put AI agents to work with clear authority, enforced policy, and independently verifiable evidence. Assess when they are ready for more responsibility while keeping security controls and human approval in place.
Control the work. Record the decisions. Review the authority.
Agents do useful work when their authority is explicit. Behavry sits in the path of the action, decides each call against your policy, and signs the result, so the question of what an agent may do next is answered from evidence rather than from its own account.
-
01 · Identity and scope
Establish
Each agent gets an identity, an owner, and a defined scope: the tools, resources, and customer or tenant it may act on.
-
02 · Policy
Evaluate
Each action is checked before it runs, on a deterministic OPA policy engine. Allow, deny, or hold for a named human. No LLM in the decision path.
-
03 · Evidence
Sign
The decision, the policy behind it, and the delegation chain become a signed, hash-chained Decision Trace that a recipient can verify.
-
04 · Authority Planned
Review
Assess readiness for broader responsibility against that evidence. A recommendation, then a human decision. Policy still applies.
Coverage depends on configuration. Behavry governs the actions that pass through a supported, configured execution path: MCP clients and IDEs, LLM API proxies, the browser, the Warden desktop proxy, and the SDKs. Actions that bypass those paths are outside the record.
More responsibility requires evidence.
A broader grant should follow a review of behavior, unresolved issues, and the work the agent is being asked to do. Behavry's Earned Autonomy approach connects that review to the controls and evidence already governing agent actions.
- 01 · RecommendationBehavry assesses the evidence
Against the criteria your tenant configures. In shadow mode, the current grant does not change.
- 02 · ApprovalA named operator decides
Someone with authority delegated by the customer accepts or declines. A recommendation is not an authorization.
- 03 · Applied grantThe change takes effect
Only after approval, and only inside existing policy, DLP, zone, and tenant controls, which still take precedence.
AvailabilityPlanned demonstration: A1 to A2 assessment in shadow mode. Recommendations leave the current grant unchanged.
Every system said yes.
Risk is often composition. Each action below was authorized in isolation by the system it touched. The exfiltration exists only in the sequence. Because every step passed through Behavry, it saw the chain, denied the final step, and recorded all five.
DECISION TRACE APR-2026-111446Three green checkmarks. One breach, stopped.
Platform logs are each system's own account. The signed chain is a record kept outside them.
Each governed action: the agent identity, the tool and target, the policy decision and the rule behind it, DLP findings, and the delegation chain back to a human.
That the package is intact and was signed by the key in the trust anchor you supply. Remove or alter an event and the chain breaks. You need no Behavry account to check it.
Events outside the governed path, and the truth of an agent's stated intent. A valid signature shows integrity and origin, not that a policy was sufficient.
Not a log. A record.
A log tells you what one system saw. A Decision Trace tells you what happened across the governed path, in a form each stakeholder can check without trusting Behavry, or you.
One trace spans multiple vendors and tools. 5 actions. 4 systems. 1 external data movement. The story three separate logs cannot tell.
Each trace is Ed25519-signed and hash-chained into an append-only ledger. Tamper-evident by construction, replayable step by step.
A removed or altered event breaks the chain. Nobody can hand an auditor a curated subset of the governed record and call it the whole.
Who asked whom, on whose authority, all the way back to a human. Authorization over the delegation chain, not just the credential.
An auditor, a regulator, or an underwriter can check a decision's integrity without logging in to Behavry.
When Behavry blocks a step it denies that one action and lets the agent keep working. A misbehaving agent surfaces as denials and an escalation, not a crash.
ONE RECORD, MANY READERS/CISO explains/CIO·CTO scales/OPERATORS review authority/LEGAL defends/BOARD oversees/UNDERWRITERS price
Why the evidence has to be independent.
Security has rested on three A's. Authentication: who are you? Authorization: what may you do? Accounting: what did you do? Agents act across environments no single vendor owns, and an actor's account of itself is the thing under examination. That is the case for a fourth.
Attestation is an independent, verifiable record of what an agent did across the systems it touched, kept by a party other than the agent, its vendor, or the system that logged it.
Behavry produces that record as a by-product of enforcing policy in the path of the action. The Fourth A is the framework we use to explain why. The Decision Trace is the artifact. Earned Autonomy is what you can do with it.
| The A | The question | Who usually holds it |
|---|---|---|
| Authentication | Who is the agent? | IAM. Okta, Entra |
| Authorization | What may it do? | Behavry, and a crowded field |
| Accounting | What did it do? | SIEM. Splunk, Datadog |
| Attestation | What did it actually do, and can you check? | A signed record from a control plane the agent cannot write to |
A Fortune 500 will run 150,000+ agents by 2028, up from fewer than 15 in 2025. Source: Gartner.
Gartner's Market Guide for Guardian Agents requires independence from the AI platforms, and requires tamper-evident audit trails. It never fuses them. The word attestation appears zero times in its 33 pages.
An actor cannot attest to itself. Behavry signs the record from a control plane separate from the agent, its vendor, and your SIEM.
Harm often lives in the crossing between systems. Being in the path across vendors is what lets Behavry enforce on the chain, and record it.
Decisions come from an OPA policy engine, fail-closed, with no LLM in the decision path. The same context produces the same decision.
There is an agent on this page. It is governed by Behavry.
Not a support bot. A security architect that answers from our published pages, and shows you its Decision Trace when it does. Every source it reads and every tool it calls is authorized by policy first, and you can watch that happen.
10:42:03 visitor.question
10:42:03 llm.classify ALLOW
10:42:03 knowledge.search ALLOW
10:42:04 source.read architecture ALLOW
10:42:04 source.read internal-roadmap DENY
reason: source classification INTERNAL
10:42:05 llm.generate ALLOWThe model is never handed a tool. It reads text and writes text. Talking it out of its instructions changes its manner, never its reach, because its reach was never in the prompt.
So try. Ask it to ignore its instructions and read something internal. Then open the trace and read the denial, with the policy that produced it.
Start somewhere:
How is this different from SIEM? → How would an MSP use it? → Try to break it →
Deploy it yourself, or through your provider.
Operate agents under your policies.
Govern supported agent workflows, review exceptions, and provide evidence for security and operational oversight.
- Policy enforced before the action runs
- Exceptions held for a named reviewer
- Signed evidence for security, audit, and risk
Build a managed AI governance service.
Govern your own AI technicians and help customers manage theirs. Add assessment, ongoing protection, and evidence-led autonomy reviews to your service offering.
- Per-customer boundaries on shared agents
- Discover, Assess, Protect, and Command
- Autonomy Review, a proposed service for partners
Where the record is already doing the work.
The same control plane, applied to the operators who need it most and the regimes that examine them. Start with the page that matches how you run.
- MSPs and MSSPs: managed AI governance, and AI technicians under clear authorityPARTNERS
- Earned Autonomy: reviewing an agent's authority against evidencePLANNED
- Financial services: SR 11-7, NYDFS, SECINDUSTRY
- Insurance: the audit trail Colorado asks forINDUSTRY
- Coverage: the agent surfaces Behavry governsSURFACES
Bring one agent workflow.
We will map its authority, show the control points, and walk through the evidence with you. MSPs can scope a pilot around one customer environment.