Design partner program: accepting through Q3 2026

AI agent governance
for production DevOps

No agent acts without authority.

Intercis intercepts each agent action on the LLM API wire before it executes, and your policy decides the verdict — a denied tool call is deleted from the response before the agent runtime can act on it, not merely flagged. Prompt-injection patterns are scanned in the same pass. Learn how it works →

Request Access See How It Works
110 deny patterns Blocks before execution Append-only audit log 90-day pilot
intercis agent-proxy · live event stream
LIVE
The failure mode

A pattern we hear from teams running agents in production: a coding agent runs an unexpected destructive command. The SOC team finds out from monitoring, not from the agent. There is no proxy in front of the agent, no policy gating the dangerous tool call, and no log of the prompt that led there. Intercis exists because that pattern has a different ending if any of those three things are in place.

Destructive commands Credential exposure No audit trail Silent failures
Live view

The SOC dashboard.

The dashboard shows each tool call an agent makes on the LLM API wire and the verdict the policy engine returned, across your whole fleet. It polls every three seconds, so what you see is what the proxy just decided.

intercis soc dashboard · governance stream
LIVE
LIVE EVENT FEED 0 ALLOW 0 DENY 0 OBSERVE
TIMEAGENTTOOLCOMMANDVERDICT
DENY: destructive action blocked ALLOW: safe action passed through OBSERVE: logged, not blocked
Watch the full demo →
How it works

Four layers.

Each agent action passes through four layers.

01

Proxy Intercept

A transparent proxy sits between your agent and the LLM API. You point the SDK's base URL at Intercis and change nothing else.

02

Injection Scanner

The scanner checks inbound user messages for prompt-injection patterns and flags them (observe-mode) before the LLM sees them.

03

Policy Engine

A deterministic deny-list of ~110 regex patterns, backed by an LLM classifier, evaluates each tool call on the LLM API wire and returns a verdict: allow, deny, or observe.

04

Audit Trail

The session log is append-only and hash-chained, so verdicts are recorded and tampering is detectable.

deny_list.py 
# ~110 regex (pattern, policy) rules · first match wins
_DENY_PATTERNS = [
  (r"terraform\s+destroy", "infra-terraform-destroy"),
  (r"kubectl\s+delete",    "infra-kubectl-delete"),
  (r"aws\s+s3\s+rm",       "cloud-aws-s3-rm"),
  # …
]

# No deny-list match → LLM classifier (fail-open, 30s timeout)
# Verdicts: allow · deny · observe

Why proxy-based enforcement is more secure than in-process SDK guardrails →

Governance

What is AI agent governance?

Production agents now hold filesystem, database, and cloud credentials. AI agent governance is the control layer in front of them: a policy decides whether each action runs, and an append-only log records what happened. The decision comes before execution, which is the part monitoring alone can't give you.

Policy enforcement

You define what actions are allowed per agent, per environment. The policy is a deterministic deny-list of regex patterns plus an LLM classifier, evaluated on the LLM API wire, and a denied tool call is removed from the response before the agent runtime can act on it.

Kill switch

One command disables an agent. The proxy starts denying its calls on the next request, without an escalation ticket in between.

Audit trail

The session log is append-only and hash-chained, so the record is tamper-evident. The agent cannot modify a log it doesn't control.

New for July 2026

Windows agents are covered too.

An agent gone rogue on Windows doesn't run rm -rf. It runs Remove-Item -Recurse -Force, deletes shadow copies, clears event logs, or dumps credentials from LSASS. The Intercis deny list has a dedicated Windows and PowerShell category built for exactly these commands: recovery inhibition, disk wipe, defense evasion, credential dumping, encoded execution, and LOLBin remote execution.

Patterns are grouped by threat category, and a subset carries OWASP agentic threat or MITRE ATT&CK technique identifiers — 16 annotations across the 110 patterns, not a per-pattern mapping. The set was validated against the documented agentic threat landscape rather than hypothetical payloads. Verified in Intercis's own production deployment (windows-lab tenant), July 2026 — 51 policy denials, 40 of them Windows/PowerShell.

Read our security practices →
110
Deny patterns
17
Threat categories
32
Windows / PowerShell patterns
51
Windows attack test cases
Proof

The claims are checkable.

Below is the SOC dashboard mid-session on our lab tenant, unretouched. The agents in the feed are the same Claude Code and OpenAI Codex instances from the demo videos, and the deny verdicts are the proxy blocking their commands on real machines. The rest of the evidence is public too.

dashboard.intercis.io · overview
LAB SESSION
Unretouched screenshot of the Intercis SOC dashboard overview during a lab session: stat cards for total events, actions blocked and observe-mode events, an event-volume chart, and the live event feed showing allow and deny verdicts on real Claude Code and Codex tool calls

Captured from the lab tenant. The full event table shows on desktop.

85.1% detection The agentic threat detection suite, published with methodology and results. Read the report → Blocked on camera Unedited lab captures of Claude Code and OpenAI Codex stopped mid-delete, July 2026. Watch the labs → Not SOC 2 certified What is and is not audited today, stated plainly before you ask. Read the security page →
Integrations

Works with what you run.

This is the actual request path. Agents call through the proxy, and only allowed tool calls reach the agent runtime. Verdicts are written to the append-only event log on a best-effort basis, queryable in the dashboard.

Where agents run
GitHub Actionsci
Kubernetesruntime
LangChainframework
tool calls
intercis proxy
IN PATH
Injection scanner inbound msgs
Policy engine 110 patterns · regex + classifier
Audit log append-only
approved
Model providers
Anthropicapi
OpenAIapi
Any LLMopenai-compat
Verdicts are written to
Event logappend-only
Dashboardqueryable

Integration is 3 lines in your agent code. The SDK itself doesn't change.

agent.py 
# Before
client = Anthropic()

# After: point the SDK at the Intercis proxy
client = Anthropic(
  base_url="https://api.intercis.io",
  api_key=INTERCIS_KEY,
)

What the proxy logs on the first run.

stdout
$ python agent.py
proxy in path · 110 deny patterns · classifier
bash.exec kubectl delete deploy api-prod DENY
fs.read config/agents.yaml ALLOW
blocked before execution · deny-list match
appended to append-only audit log
Pricing

Two plans, priced per agent.

Design partners get 40% off the listed rate and a direct line into the roadmap.

Design Partner
For Scaling Teams

Team

$200/mo

for 1 agent · unlimited events

1 agent
1 AGENT 20 AGENTS

90-day pilot, cancel any time

  • Proxy intercept + policy engine
  • Prompt-injection scanning (observe mode)
  • Append-only, hash-chained audit log
  • Audit log + governance dashboard
Start a 90-day pilot
Hardened
For Enterprise Infra

Enterprise

Custom Pricing

quoted per fleet · unlimited events

Deployment

Intercis runs today as a hosted proxy (api.intercis.io); the audit log lives in managed Postgres. A customer-VPC deployment is in lab validation (Phase 3.7) — self-host licensing is not yet decided, one of our honest costs.

Everything in Team, plus

  • Vendor security questionnaire support (certification status)
  • CSV export from the dashboard event view
  • VPC deployment (in lab validation)
  • Priority Slack Support
Contact Sales

Learn more about AI agent governance

What is AI agent governance? Proxy vs SDK enforcement The incident that started it all All posts →
Design Partner Program

Working with three teams. Bandwidth for one more this quarter.

Design partners get 40% off and a dedicated line to the founder for roadmap requests. We only accept teams already running AI agents in production.

No trackers on this site