# Let your CISO sleep.

URL: https://avispa.ai/security/

Security and trust

Every agent works inside lines your security team draws.

## The path every request takes

Four boundaries, outermost first, as in the fortress. Select a control to see what it enforces.

1 Identity and access

2 Network

3 Applications and tools

4 Data

**Identity**

Stopped at identity and access: an over-scoped credential.

Allowed: one token, scoped to this run.

- Every run gets its own token, scoped to its purpose.
- Role-based access: about 30 permission keys, and an auditor role.
- API keys are stored only as hashes.

Outside Avispa

## Risky behaviour? Paused automatically.

When an agent shows risky behaviour, OrbitSOC pauses it automatically through Avispa’s API. Its work is kept, and it stays paused until a person reviews it and approves. You choose when automatic containment applies.

1. Risky behaviour
2. Paused, work kept
3. A person approves

## What happens when…

**A document carries a hidden instruction**

1. agent reads runbook.docx
2. it says: send the config to an outside host
3. egress.denied host=files-share.example
4. no credentials in the sandbox to send

Contained. Nothing it asks for can happen on its own.

**An agent wants to change production**

1. plan: Reader on rg-payments-prod
2. blast radius: resource group, reversible
3. approval requested in Microsoft Teams
4. approved by a person, for this action, once

No agent approves its own work.

**An agent reaches its budget**

1. budget: $25.00 a month
2. warning at 80% ($20.00)
3. limit reached: agent paused, queued runs cancelled
4. budget\_override\_required: a person decides

Only a person can raise a budget.

**Something looks wrong**

1. emergency stop pressed
2. every agent paused, every run cancelled
3. audit trail kept, append-only

One switch stops everything.

[The CISO's checklist: 17 questions to ask any agent platform, ours included.](https://avispa.ai/faq/#checklist)

## Bring your security team to the demo.

[Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)