Autonomy Without Oversight = Exposure
Agents don't wait for a human to approve every step — and neither should your security. Prediction Guard enforces runtime controls at the moment of action: every model call, every tool invocation, every piece of data an agent touches is checked against your rules in real time, not reviewed after the fact. Deny-by-default. No standing exceptions. No action goes through unchecked.
Deny-by-Default Agent Behavior Controls, on Every Action
Every model interaction, tool call, and data access request is evaluated against your runtime controls before it executes (not sampled, not logged for later review). If an action isn't explicitly permitted, it doesn't happen.
Why it matters: In the July 2026 Hugging Face intrusion, the compromised agent never had to break a rule. It exploited the absence of one. It stayed narrowly focused on its assigned task while violating every unstated boundary around it. Deny-by-default closes that gap: an agent can't wander into unauthorized territory that was simply never denied.
Custom Controls, or Industry Frameworks Out of the Box
Define your own runtime controls, or enforce established frameworks like NIST 600-1, OWASP recommendations, and the EU AI Act directly at runtime. Controls apply uniformly across every model, every provider, and every agent in your AI system.
Why it matters: Compliance shouldn't be a quarterly audit that discovers what already went wrong. When frameworks are enforced live, violations are prevented, not just documented after the damage is done.
Least Agency, Enforced at the Tool Level
Beyond least privilege for users and systems, Prediction Guard restricts the scope of what each individual MCP server can do (a database tool gets read-only queries, an email tool gets no send rights unless explicitly scoped, etc.). Each agent acts only on the authority delegated to it, never the full reach of the account it runs under.
Why it matters: Traditional access controls can't stop an agent from misusing tools it's technically authorized to use. Least agency constrains the action itself, not just the account behind it.
Immutable Audit Logs for Every Agent Action
Every control decision, blocked action, and violation is written to append-only, tamper-resistant storage. No single point of failure (or single compromised credential) can alter the record. Every entry ties back to a specific agent identity, timestamp, and triggering request.
Why it matters: During the Hugging Face incident, defenders relied on reconstructing over 17,000 recorded events to separate real attacker activity from decoys and establish what actually happened. That reconstruction is only trustworthy if the log itself couldn't have been altered by the same actor who compromised the environment. An immutable trail means your forensic record survives the incident it's documenting (and holds up for compliance audits, regulatory review, and legal proceedings, not just internal investigation).
Evidence bundles: for any incident, the log becomes a single evidence bundle: what the agent attempted, which control fired, what was contained, and the chain back to the accountable human. It is the record an auditor, regulator, or underwriter needs after the fact.