Candor Agent Defense sits between your agents and the systems they act on. Every action is checked twice before it runs: is this agent who it claims and acting within what it was granted, and is the action itself dangerous. High-impact actions wait for a person. A compromised supervisor loses its whole delegation tree in one step. Every decision is written to a hash-chained record your auditor can verify.
Every capability on this page is tied to a dated test record. Where we have not tested something, the page says so.
One agent with one job is a model-quality problem. Tens of agents that spawn other agents, pass work between them and hold credentials to business systems are an authority problem. The questions a security or risk owner has to answer are about who was allowed to do what, on whose authority, and what happens when one of them is compromised.
A supervisor agent hands scope to workers. If the supervisor is compromised, every agent acting on its delegation is acting on bad authority, even if each one looks healthy on its own.
An agent that can read a credential store, call a payment API or send mail as the company is a principal in your environment. It needs an identity that can be verified and revoked like one.
After an incident, an auditor, a regulator or the board asks for the record. A log that could have been edited afterwards does not answer that question.
Identity and authority are decided in one place. The safety of the action is decided in another. Neither plane can stand in for the other, and an action has to pass both.
Issues each agent’s identity and credential, records who delegated what to whom, checks every action against the authority actually granted, holds high-impact actions for a human, and revokes authority for one agent or a whole delegation tree.
Evaluates the action itself at the point of execution. A dangerous action is contained at the engine: the agent is quarantined and every further action from it is refused until an operator reviews it.
The join between the two is where fleet incidents show up. A harmless-looking action from a forged credential is a finding. So is a correctly credentialed agent attempting something dangerous. A single filter in front of a model sees neither clearly.
Every agent presents a credential. Forged, reused or missing credentials are refused. The action is compared with the authority that agent was granted.
An action marked high impact does not run on the agent’s say. It is escalated, a named person allows or denies it, and that approval can be used once.
A dangerous action, such as an attempt to exfiltrate credentials, is stopped and the agent is quarantined. Every further action from it is refused.
Declare a supervisor compromised and every agent in its delegation tree loses authority on both planes at once. A replacement generation comes up with fresh identities.
A restored agent does not return to full trust. It has to complete ten consecutive clean actions. A medium-risk signal during probation contains it again.
Run both planes without blocking anything and record what each would have done. Reports are generated from the ledger, chain-verified first, with coverage gaps stated.
We do not list a capability because it is in the code. Each one below was exercised on our live range or deployed source, and the result was written to the same kind of hash-chained record a customer receives. The full table, with the test behind each line, is on the evidence page.
Governed actions are sent for evaluation before they execute. Onboarding registers your agents from a roster or from discovery. Most engagements start without changing agent code.
Decisions are made by Candor’s own model on Candor-operated infrastructure. No third-party AI provider reads your agents’ actions. The ledger stores decisions and matched fragments, not full payloads.
The machines that run the two planes have no egress except their private network. That is tested with probes, not asserted.
A sandbox limits what an agent can reach. Agent Defense decides whether a specific action by a specific agent should run. Tested compatible with NVIDIA OpenShell: identical outcomes inside the sandbox and outside it.
Dedicated or on-premises deployment is available at the Enterprise tier and is scoped jointly.
An enterprise buyer should know exactly where the verified ground ends. These are the items we have not yet exercised as tests. For larger estates they are part of the Assurance and Enterprise scope, and we test them with you.
Enforcement on a fleet you have not measured is guesswork. The first step is a fixed-price Discovery: we inventory the fleet, give every agent an identity, run both planes in observation mode and hand you a signed report of what would have been contained. The fee is credited in full if you proceed to enforcement within 30 days.
| Discovery | Best fit | Window and fee |
|---|---|---|
| Launch | First production agent or a single workflow. | 5 business days $5,000 |
| Growth | Multiple agents or several business systems. | 10 business days $12,500 |
| Assurance | Regulated or high-consequence environments. | 15 business days $30,000 |
| Enterprise | Complex estates, multiple regions, dedicated or on-premises deployment. | Scoped From $60,000 |
No. It governs actions, not model output. The check happens where an agent tries to do something: call a tool, use a credential, send a message, change a record.
A sandbox sets the outer wall: what the agent could reach at all. Agent Defense decides, inside that wall, whether this agent is who it claims, whether this action is within its grant, and whether it should wait for a person. The two are complementary, and we have tested them together.
In our endurance run the 90th-percentile decision latency was 2.4 seconds on the sovereign local model, across 600 consecutive evaluations. That figure is from our range. Yours is measured during Discovery.
A named person, and the approval is recorded and usable once. The approval route for your organization is agreed during onboarding.
It stays contained until an operator restores it. A restored agent is on probation and must complete ten consecutive clean actions before it returns to normal.
Our verified runs are at a ten-agent delegation tree. Larger populations are scoped under Assurance and Enterprise, with the population test as part of the engagement.
Roughly how many agents, where they run and which systems they act on. We will tell you which tier fits and what the first report would cover.
Talk to us about your fleet →