Security model
AgentKeeper sits between supported AI agent actions and the organization policy that decides whether those actions pass, warn, or block.
AgentKeeper sits between supported AI agent actions and the organization policy that decides whether those actions pass, warn, or block.
Service boundary
AgentKeeper has three main control surfaces:
- Local runtime hooks: installed per agent surface, such as Claude Code, Cowork, Cursor, Codex, Gemini CLI, Google Antigravity, Copilot, or Windsurf.
- MCP Gateway: a local gateway that can proxy MCP server traffic and evaluate MCP tool calls, including Claude Chat in Claude Desktop.
- Dashboard control plane: policies, identity, directory sync, activity, investigations, and admin settings.
The local surface emits runtime evidence. The dashboard stores policy and audit context. The evaluation API returns a verdict when the integration supports pre-execution enforcement.
Fail-open behavior
AgentKeeper is designed to avoid breaking developer workstations during service or network problems. If a local hook cannot reach the evaluation endpoint, the integration should fail open where supported and record the condition locally or in a system event when it can.
Fail-open does not mean invisible. Admins should still monitor for:
- Missing activity from a previously healthy host.
- A source that produces system events but no runtime events.
- Policy evaluation errors.
- Gateway authentication or configuration failures.
Fail-open also does not mean users should bypass local controls. AgentKeeper has a dedicated Control integrity model for detecting hook tampering, bypass requests, helper-script workarounds, and approved security-testing exceptions.
Policy resolution
Runtime policy should be understandable in this order:
- Base Policy applies to every session.
- Policy packs add group-specific controls when the user or workstation resolves to that audience.
- Detector response decides whether matching evidence is observed, warned, or blocked.
- Built-in safety defaults remain underneath configured policy.
For a simpler rollout, start with Base Policy and one pilot policy pack. Add more packs only when the audience distinction is real.
Identity boundary
SSO and Directory Sync solve different problems:
- SSO authenticates dashboard login.
- Directory Sync supplies users and groups for policy-pack assignment.
- Workstation identity ties runtime events to accountable people when there is enough evidence.
Do not rely on SSO alone for group-based runtime policy. Configure Directory Sync when policy packs need authoritative group membership.
Admin controls
Restrict these actions to owner/admin roles:
- Creating or changing SSO connections.
- Creating or changing Directory Sync connections.
- Editing Base Policy.
- Creating or assigning policy packs.
- Creating, rotating, or deleting API keys.
- Deleting workstation records.
- Deleting or disabling enterprise integrations.
- Changing privacy, Prompt Vault, notification, connector, MCP Gateway, or AgentKeeper MCP Server client settings.
- Running MCP policy simulations or exporting MCP Gateway event evidence.
- Revealing sealed prompt evidence with a required reason.
Organization roles
| Role | Intended access |
|---|---|
| Owner | Full organization administration, including admin management, access, security integrations, policy, privacy, Prompt Vault, notifications, API keys, MCP controls, sealed exports, and audited prompt unseal. |
| Admin | Security administration for the organization, including Developer invites, integrations, policy, privacy, Prompt Vault, notifications, API keys, MCP controls, sealed exports, and audited prompt unseal. Admins cannot invite, promote, demote, or remove other Admins. |
| Developer | Runtime-focused access for users whose workstations and agent activity may be monitored. Developers can view allowed evidence surfaces, but cannot manage access, privacy, Prompt Vault, notifications, connectors, API keys, policy, MCP controls, exports, or prompt unseal. |
Legacy member records are migrated to Developer. During rollout, AgentKeeper treats any remaining legacy Member row as Developer-compatible read-only access.
Sensitive prompt evidence
Prompt Vault Sealed Evidence stores raw prompt text encrypted and hidden by default. Activity, Workstations, Investigations, OTLP prompt groups, raw JSON panels, exports, and MCP evidence responses use sealed metadata such as evidence ID, prompt hash, prompt length, source, session, and placeholder text.
Owners and Admins can unseal retained prompt evidence only through an explicit reveal flow with a reason. AgentKeeper writes an append-only audit record before decrypting and returning the prompt. Developers and legacy Members cannot unseal prompts.
Validation rule
A security control is not considered live until Activity proves it:
- The workstation is registered.
- The source emits a PASS event when full audit logging is enabled.
- The source emits a BLOCK event for a known denied action.
- The event resolves to the expected person, group, and policy.
- Control integrity checks show the hook, local state, and managed configuration have not been weakened.