GuardBotAI

ENTERPRISE CONTAINMENT

The triple-layered sandbox, in detail

Most AI security controls answer one question: was this request allowed? Containment answers a second one that matters more to a board: when an agent starts behaving badly, how far can it get before something stops it — and who finds out? GuardBotAI's answer is three layers, automatic demotion between them, and an alarm the moment a layer is crossed.

The three layers

Layer 1 — Practice

What it permits:
Nothing is forwarded. Every request is judged against your policy and written to the record.
When you use it:
First week of a new agent, a change to an existing policy, or any agent under investigation.
How an agent leaves it:
A named person promotes it deliberately, and the approval is recorded with their identity and the time.

Layer 2 — Leashed

What it permits:
Forwarded only to that agent's own approved destination, only to allow-listed tools, under tighter size and rate ceilings than your own policy sets.
When you use it:
Controlled production pilots, agents that touch regulated data, third-party or partner-built agents.
How an agent leaves it:
Upward only by recorded human approval. Downward automatically and immediately on any breach.

Layer 3 — Live

What it permits:
Full approved operation under the rules your team wrote, with every decision still recorded.
When you use it:
Agents that have proven themselves at layer 2 and carry an owner accountable for them.
How an agent leaves it:
Dropped one layer the instant a breakout signal fires — no human in the loop, because containment cannot wait for one.

The rule behind all three is simple and deliberately asymmetric: loosening containment always takes a person, tightening it never does.

What counts as a breakout

A tool that is not on the list

An agent asks for a tool outside its allow-list while leashed. The request is refused and the agent drops a layer. An empty allow-list means no tool restriction, so this only fires when you have actually named the permitted tools.

An unapproved destination

A leashed agent tries to reach anything other than the destination approved for it. Nothing is forwarded.

A block storm

A burst of refused requests from one agent inside a few minutes reads as probing rather than use, and containment tightens on its own.

A request-rate spike

Traffic well above the ceiling set for that layer is treated as loss of control, not as growth.

Swarm coordination

The same blocked pattern appearing across several of your agents inside minutes is the case enterprise buyers ask about most: agents converging on one route out. It is treated as coordination and contained.

Real-time breakout alarms

A demotion does four things at once. It writes the reason into the tamper-evident record, where each entry carries the hash of the one before it. It emails every owner and admin of the workspace within seconds — one message per incident, not one per refused request, so a storm does not bury the alert it caused. It raises a banner in the control center that stays until a person acknowledges it. And it leaves the agent at the lower layer until someone with authority moves it back.

One control drops an entire workspace to Practice in a single action, for the case where you would rather stop everything and work out what happened afterwards.

What we do not claim

  • • We do not claim to prevent every form of agent escape. We contain, record and alert.
  • • Layered encryption is not containment. Encrypting data between layers does nothing about an agent that can call a tool; what stops it is each layer sitting at a different trust boundary.
  • • We hold no external security certification today, and say so plainly on the trust policy page.
Request a GuardBotSee a recorded demotionRead the analysisEnterprise terms