Say yes to agents. We own the blast radius.
Your engineers will run agents whether you allow them to or not. agen-x is the one place where the guardrails are on for every agent, and someone else keeps them on. Isolated, fenced, audited, metered.
Is agen-x secure enough for a security engineer to approve?
agen-x enforces governance in the platform, not a PDF: verifiable workspace sandboxing, true tenant isolation, strict network boundaries with allowlists, scoped credentials never written to disk, native SSO and MFA, full audit export, hard budget caps, and ask-a-human interrupts for any runtime. It is not SOC 2 yet. Available now: the architecture doc, an external scan report, the DPA, and a sandboxed org to attack before you sign.
Governance is what the platform is.
Most hosts hope for the best. agen-x enforces isolation, network boundaries, and audit on every agent automatically, and keeps them on across every release. One platform to approve.
Objections Security raises
Security capabilities, and the risk each one mitigates
Verified sandboxing
Mitigates the container-escape surface.
True tenant isolation
Mitigates cross-tenant exposure.
Strict network boundaries
Mitigates exfiltration and stealer payloads.
Scoped, vaulted credentials
Mitigates plaintext-token leaks.
Native SSO and MFA
Mitigates unmanaged access.
Full audit export
Mitigates “we don’t know what it did.”
Hard budget caps
Mitigates uncontrolled spend.
The security kit, available now
Not SOC 2 yet. We start when two customers make it a renewal condition. What a security engineer can verify today: the architecture, an external scan, the DPA, and a sandbox to attack.
The agen-x architecture doc
Isolation, egress, credentials, audit, data flow, and the control mapping — the document that is the agent policy. Forward it to your security engineer.
External scan report
The latest third-party scan of the platform’s public surface. Sent on request.
Ask on the security call →Vulnerability-disclosure policy
How to report, what we commit to, and how we credit researchers.
Ask on the security call →DPA + subprocessor list
A standard data-processing agreement and the subprocessors behind it.
Ask on the security call →Request a sandbox to attack
A sandboxed org for your security engineer to attack for a week before anyone signs. The audit log is the scoreboard.
Read the architecture. Watch the fence hold.
Get the architecture doc, or ask for a sandboxed org and try to break it first.
