The strongest control is that nothing leaves.
Agent Access Manager runs inside your perimeter, on your provider accounts, against your own database. Everything below is layered on top of that starting position.
Six control families on the same request path.
Each is configurable per organization and produces its own evidence, so a control you claim is a control you can demonstrate.
Credential isolation
Vendor master keys are held by the gateway, not by the applications that use them.
- Provider credentials AES-256-GCM encrypted at rest; the application refuses to start without a master key
- Credentials are never returned to a client — decrypted only to sign an outbound provider call
- Key rotation re-encrypts and swaps the credential, effective on the next request with no cache to drain
- Virtual keys are high-entropy tokens stored as SHA-256 hashes, never recoverable from the database
Least-privilege access
Every consumer holds the narrowest credential that still lets it work.
- Scoped virtual keys per application, agent, team, or project — revocable and expiring
- Key placement is authorized: a member cannot mint a key outside their own organization
- Per-scope key-count ceilings bound how much credential surface can exist at all
- Nested, fail-closed role model separating gateway operation from spend authority
Data-loss prevention
Content is inspected on the way out and on the way back, before it reaches a vendor or a user.
- Detectors for PII and secrets, plus organization-defined categories and custom patterns
- Redaction strategies: mask, hash, partial, and reversible token substitution
- Streaming responses screened inline, holding a match that spans a chunk boundary
- Fail-closed posture per rule so an unfinished scan blocks rather than leaks
- Remote AI classifiers supported for judgement calls regex cannot make
Abuse containment
Detection is only useful if something happens next. Containment actions are automatic and reversible.
- Sigma-compatible detection rules and behavioral analytics over the governed event stream
- Automated quarantine suspends a key; automated throttle tightens its rate limits
- Both actions auto-revert, so a false positive degrades service rather than ending it
- Permanent revocation stays a deliberate human action
Evidence and retention
The audit trail is a system of record, not a log file that rotates away.
- Durable transactional outbox: an event is recorded even if a consumer is offline
- Per-call identity, provider, model, tokens, cost, policy decision, and outcome
- Month-partitioned storage with configurable retention — opt-in, and never lossy by default
- Optional OpenSearch projection with hot → archive → delete and snapshots to S3-compatible storage
- Scheduled usage and security reports export as PDF, CSV, JSON, or HTML
Data residency
The deployment model is the strongest control: nothing leaves your perimeter by design.
- Customer-managed software in your cloud or data center — no vendor-hosted control plane
- Prompts, responses, credentials, and audit data stay in your infrastructure
- Provider usage runs on your own vendor accounts and invoices
- Offline and air-gapped installation supported
- No telemetry path back to AethosHub is required for the product to function
A gateway is a privileged position.
Anything that sits between your applications and every model vendor holds every credential and sees every prompt. We treat the dependency footprint of that component as a first-order security property.
- A single deployable JVM service with an explicitly reviewed dependency set — no speculative or unused libraries
- No embedded Python runtime and no bundled third-party proxy in the request path
- Container images and Helm charts published as versioned artifacts with an offline installation path
- Guardrail classifier sidecars are opt-in, not required for the gateway to run
Find the call, then find everything like it.
Guardrail findings and model calls land in the same searchable trail, so an investigation moves from a single alert to the pattern behind it.
Filter governed calls by organization, team, project, model, provider, or outcome, over an indexed time window.
Sigma rules and behavioral analytics run over the normalized event stream to surface abuse that a single call would not reveal.
Quarantine or throttle the offending key automatically, with both actions auto-reverting so a false positive is not an outage.
Security questions we are asked in review.
Straight answers about data handling, containment, and what the product does and does not claim.
Where do prompts and responses go?
To the provider you configured, and nowhere else. Agent Access Manager is customer-managed software running inside your own environment. Prompt and response content passes through the gateway to your vendor account; metadata about the call is recorded in your own database. There is no vendor-hosted control plane and no required telemetry channel back to AethosHub.
Can it stop an agent from leaking secrets or personal data to a model provider?
Guardrails screen request content before it is forwarded and response content before it reaches the application. Findings can be allowed, flagged, redacted, or blocked, with mask, hash, partial, or reversible token strategies. Streaming responses are screened inline, including matches that span a chunk boundary. Detection coverage depends on the detectors and policies you configure — regex detectors with validators are in-process, and remote AI classifiers can be attached for judgement calls.
What happens if a virtual key is compromised?
Revoke it. The consumer loses access immediately and the underlying provider credential is untouched, so no other application is disrupted and no vendor-side rotation is needed. The audit trail retains everything that key did. If a detection fires before anyone notices, SOAR containment can quarantine or throttle the key automatically, and both actions revert on their own.
Does it produce evidence we can hand to an auditor?
Every governed request is recorded with the applicable identity, policy decision, provider, model, token usage, cost, and outcome, and the trail is searchable. Usage and security reports export in PDF, CSV, JSON, and HTML on a schedule. The product supplies the evidence; mapping it to a specific SOC 2 or ISO 27001 control remains your programme's work, and Agent Access Manager itself is not a certification.
How is the admin console protected?
The administrative plane is separate from the data plane. It always accepts an HTTP Basic break-glass administrator, and optionally validates OIDC bearer tokens as an OAuth2 resource server against your identity provider — signature, issuer, expiry, and audience — mapping realm roles to authorities. When an SSO client is configured the dashboard becomes SSO-first, and the human session lives at the identity provider rather than in the gateway.
Bring your security review.
We will walk your architecture, data-handling, and evidence requirements end to end, and tell you plainly where the product does not yet reach.
We typically respond within one business day.