Security
Agents with guardrails.
Isolation, gateway policies, audit trails, and governance so security teams can say yes to more agent work.
What security teams ask
Agents generate untrusted code
LLM output may be wrong or malicious. Run it on disposable computers, not laptops or prod.
Tool access needs least privilege
Gateway profiles scope which hosts, paths, and methods each computer can reach.
Security teams need audit trails
Per-request gateway logs show what each agent called, what was blocked, and when. Export them to the same SIEM you already review.
Rollout needs governance
Credentials, network access, and integrations should differ by team and workflow. Governance is structural: profiles you assign, not policies you hope agents follow.
How the controls work
Isolation
microVM per agent computer
Stronger boundary than containers alone for untrusted or production-adjacent work.
Gateway
Credential injection and egress policies
Inject tokens per request. Block risky hosts and filter response bodies.
Audit
A trail on every outbound call
Who, what, where, and when on each request, allowed or denied. Stream logs to your SIEM so an auditor question becomes a query.
Governance
Scoped access per team and workflow
Gateway profiles control which credentials and APIs each computer gets. Roll agents out gradually without minting new tokens for every run.
BYOC
Your cloud, your audit sinks
Deploy the control plane and agent computers in your VPC when regulated workloads require it.
Common questions
How are agents isolated?
Each agent runs on its own microVM computer with scoped network policies.
Where are credentials stored?
Secrets are injected at the gateway boundary. Agents get access, never keys.
Can we audit every API call?
Yes. Every outbound request is logged with who, what, where, and when. Allowed and denied calls both show up. Export the trail to your SIEM or data warehouse so review is a query, not a meeting.
How do you govern access across teams?
Gateway profiles scope credentials, hosts, and paths per team, workflow, or computer. You widen access one group at a time instead of handing every agent the same keys.
Can we run entirely in our VPC?
Yes. BYOC deploys the Islo control plane and agent computers inside your cloud account, with audit exported to the sink you already use.
What about data retention?
Contact support@islo.dev for data retention and compliance documentation.