Questions by role
Three roles. Three sets of questions. One authorization layer.
AI agent deployment touches the CTO who builds, the CISO who validates, and the board that governs. Each asks different questions. Behavry answers all of them.
What your CTO needs to know.
The CTO owns the deployment. These are the questions that determine whether AI ships to production or stays in a sandbox.
Does this slow down my developers?
No. OPA policy evaluation runs in microseconds. Total authorizer overhead is under 5ms per request. For context, LLM inference takes 500ms–5s. Developers only see the authorization layer when an action actually violates policy. Safe actions auto-approve at full speed.
How long does deployment take?
Agents point their MCP config at the Behavry authorizer URL. That's a config file change, not a code change. A team can be authorized in an afternoon. Full enterprise rollout, with IdP connectors, SIEM integration, and custom policies, typically takes days, not weeks.
What agents and tools do you support?
11 MCP clients (Claude Desktop, Claude Code, Cursor, Windsurf, Zed, VS Code, JetBrains, Warp, Cline, Continue, Open Interpreter). 6 API proxies (OpenAI, Anthropic, Gemini, Ollama, NemoClaw, OpenShell). 12 browser services. 7 vibe-coding platforms. Any MCP client that speaks Streamable HTTP or stdio works out of the box.
Can this run in our infrastructure?
Four deployment models: Full SaaS (fastest start), Hybrid (control plane SaaS, data plane in your VPC), BYOC (Helm + Terraform in your cloud), Self-Hosted (air-gapped). All four share a single data plane image with identical capabilities. Agent traffic stays in your network on Hybrid, BYOC, and Self-Hosted.
Do my developers have to change their code?
Zero agent code changes. Agents point at the Behavry authorizer URL instead of the target MCP server URL. That's a JSON config change. The authorizer is transparent: agents see standard MCP protocol responses. No SDK required, no wrapper functions, no instrumentation.
What does this give me that network-layer controls can't?
Network-layer tools see the prompt. Behavry sees the tool call. A network filter can block an agent from calling a domain. Behavry can block a specific agent from calling a specific function on a specific resource based on who that agent is, what risk tier it's in, and what it's done in this session. That's the difference between a firewall and an authorization layer.
What your CISO will validate.
The CISO doesn't buy Behavry. But the CISO validates that the authorization layer meets security requirements. These are the questions they'll bring.
How do you handle DLP for AI agent interactions?
26 DLP patterns scan every tool call payload. Patterns include AWS/GCP/Azure credentials, API tokens, private keys, SSNs (with Luhn validation), credit cards, and PII. Critical-severity patterns auto-deny before OPA policy evaluation. The full 4-stage data protection pipeline includes classification, redaction with pseudonymization, BYOK encryption (AES-256-GCM + AWS KMS), and retention purge with immutable decryption audit trail.
What does the audit trail actually look like?
The Decision Trace is not a log. It's a causal chain-of-custody artifact. Every event records the agent identity, the tool call, the authorization decision (allow / deny / intercept), the DLP findings, the behavioral risk score, the workflow session, the parent event, and the causal depth. Events are SHA-256 hash-chained. The chain is verified nightly. This artifact can only be produced from an inline execution-path position. That is why observe-and-detect approaches can't replicate it.
How do you detect prompt injection and inbound attacks?
Behavry scans MCP tool call responses before they reach agent context. 16 detection patterns across 7 attack classes: imperative commands, authority claims, permission expansion, role reassignment, encoded payloads, exfiltration instructions, and conditioning sequences. Critical findings trigger Intercept escalation with allow-sanitized, allow-original, or deny options.
What compliance frameworks do you map to?
SOC 2 (CC6.1, CC6.7, CC7.2–7.4), ISO 27001 (A.12.4.1, A.12.4.2, A.9.4.1), EU AI Act (Art. 9, 13, 14), NIST AI RMF (all four functions), GDPR Art. 32, and HIPAA §164.312. Plus full OWASP ASI Top 10 mapping with live 30-day metrics.
Can agents bypass the authorizer?
In a properly configured deployment, MCP target servers are only reachable through the Behavry authorizer via network segmentation. Direct connections are monitored and flagged. This is standard zero-trust architecture.
How do you handle multi-agent delegation chains?
Behavry's workflow authorization tracks delegation chains with cryptographic session tokens (wf_token JWT). Every tool call in a multi-agent pipeline records its parent event ID, causal depth, and the full delegation chain. Cross-session trust reset detection prevents persistent compromised behavior across session boundaries. Blast radius limits cap the total impact of any single delegation chain.
How the board will frame it.
The board doesn't ask about OPA policies. They ask about risk, accountability, and whether the organization can prove what happened.
How many AI agents are running in our environment, and who authorized them?
Behavry's AI Surface Discovery answers this directly. 30 AI-capable SaaS platforms are fingerprinted and tracked through a four-state model: Licensed, Enabled, Active, and Authorized. IdP connectors (Okta, Azure AD, Google) cross-reference who has access. SaaS admin API connectors confirm what's enabled. The exposure score tells you the gap between what's running and what's authorized.
If an AI agent causes a data breach, can we prove what happened?
Yes. The Decision Trace provides a complete, immutable, hash-chained record of every action every authorized agent took, including the policy decision, the data classification, and the delegation chain if the action was part of a multi-agent workflow. This artifact is exportable for legal and audit review.
What happens when an agent does something it shouldn't?
It depends on what the policy says. Behavry supports three outcomes: Allow (action proceeds, audit logged), Deny (action blocked, agent receives error, audit logged), and Intercept (action held, human reviewer approves or rejects, agent receives the decision). The global kill switch suspends all agent activity instantly when needed. Per-agent rate limiting tightens automatically as risk scores increase.
Are we compliant with the EU AI Act and other emerging regulations?
Behavry maps directly to EU AI Act Articles 9 (risk management), 13 (transparency), and 14 (human oversight). The Decision Trace provides the transparency artifact. Intercept provides the human oversight mechanism. Behavioral risk scoring provides the risk management framework. Compliance PDF export produces a branded, auditor-ready report with framework mapping, control status, and audit statistics.
What's our liability if employees are building apps with AI tools we don't authorize?
This is the citizen-coder problem. Employees using Replit, Lovable, Bolt, and similar platforms are shipping production apps without security review. Behavry discovers these apps via browser extension fingerprinting and platform API connectors, scores them across 7 risk signals, and enforces OPA policies, from auto-enrollment to denial. The 30-day unauthorized SLA ensures nothing stays invisible indefinitely.
How do we know this authorization layer itself is trustworthy?
The Attestation Separation Principle: any entity that can act cannot independently attest to its own behavior. Behavry is architecturally independent from the agents it authorizes. It doesn't modify agent code, doesn't run inside agent processes, and doesn't depend on agent self-reporting. The authorizer sits in the network path. The audit chain is hash-verified. The authorization layer is provably separate from the thing being authorized.
CISO gets accountability/Board gets oversight/Team gets to ship
The authorization layer that lets everyone say yes.
BOOK A BRIEFING →