Security and trust
Let your CISO sleep.
Every agent works inside lines your security team draws.
The path every request takes
Four boundaries, outermost first, as in the fortress. Select a control to see what it enforces.
1Identity and access
2Network
3Applications and tools
4Data
Outside Avispa
Risky behaviour? Paused automatically.
When an agent shows risky behaviour, OrbitSOC pauses it automatically through Avispa’s API. Its work is kept, and it stays paused until a person reviews it and approves. You choose when automatic containment applies.
- Risky behaviour
- Paused, work kept
- A person approves
What happens when…
- agent reads runbook.docx
- it says: send the config to an outside host
- egress.denied host=files-share.example
- no credentials in the sandbox to send
Contained. Nothing it asks for can happen on its own.
- plan: Reader on rg-payments-prod
- blast radius: resource group, reversible
- approval requested in Microsoft Teams
- approved by a person, for this action, once
No agent approves its own work.
- budget: $25.00 a month
- warning at 80% ($20.00)
- limit reached: agent paused, queued runs cancelled
- budget_override_required: a person decides
Only a person can raise a budget.
- emergency stop pressed
- every agent paused, every run cancelled
- audit trail kept, append-only
One switch stops everything.