Before the funds leave your treasury. Before the agent pushes to production.
Built for the Risk and Compliance teams that have to defend the decision long after the agent moved on.
The next incident won't be a hallucination. It will be an authorized action.
A transfer to a new payee. A force-push outside the release window. An export to the wrong domain. Every permission was granted. Nobody approved the outcome.
Atbash puts a decision, an owner and a record at the one point where that outcome can still be stopped.
Where agents do work you'll have to answer for
Never pay an unverified payee without approval.
Never push to a protected branch outside the release window.
Never export customer records to an unapproved system.
Orders above a set threshold need a clinician's sign-off.
Never sign beyond delegated commercial authority.
thresholds and rules shown are illustrative
Evidence per decision, not a quarterly snapshot.
Inside the stack you already run.
Plugins for seven agent frameworks, plus SDK, API and CLI. Configured with our team.
It doesn't replace your stack. It decides where your stack doesn't.
| TOOL CLASS | DECIDES | ATBASH ADDS |
|---|---|---|
| Model guardrails | What the model may say | Whether the action it chose may run |
| Agent gateways | Which traffic reaches which service | A verdict per tool call, judged against the mandate |
| AI discovery and endpoint security | Which AI tools are running | Whether this action, by this agent, is allowed now |
| IAM and permissions | What an identity can access | What an agent may do with that access, case by case |
| GRC and audit | Policies and periodic evidence | A signed record per decision, reconstructible on demand |