Twelve posts: eleven from April 8 to 13, 2026, and one from September 18, 2026. Written by Jay Cabello, who builds Intercis. Every number on them is on the validation report with the command that produced it, and how this archive is kept honest is at the foot.
Eight checks a security team can run on its own AI agents this quarter, and which of the eight Intercis answers today.
Our own miss rate on the same kind of test. 40 of 47 payloads, and the seven it misses.
Our own account of an agent with filesystem access that started deleting production files. The SOC caught it six minutes in, after the damage.
The same call, denied by our proxy, comes back without the tool call in it. The response, before and after.
SIEMs detect after execution. SOAR orchestrates known playbooks. Guardrails filter text. None of them intercept AI agent tool calls before they execute.
Our deterministic layer catches 40 of 47 payloads on our own corpus, and the seven it misses are written down.
The seventeen agent security risks OWASP lists in Agentic AI Threats and Mitigations v1.1, and which of them a proxy can reach at all.
We publish no coverage score against that list. What we publish is 40 of 47 on our own corpus.
OWASP lists tool misuse at T2. What it looks like on the wire when the agent holds API and infrastructure access, and why a text filter never sees it.
This is the threat our deny list is aimed at. It catches 40 of 47, and the seven it misses are documented.
OWASP puts repudiation at T8: an agent can act without leaving enough behind to reconstruct what it did. If the trail starts at the SIEM, it is already gone.
Ours starts at the decision rather than at the SIEM: SHA-256 over every field of the row but the tool input for events recorded from 2026-09-20, one chain per tenant; events recorded before 2026-09-20 are hashed over ten named fields.
What an auditor asks for when the thing taking the action is an agent, which of it a proxy log can answer, and which fields you have to hold yourself.
Before you map any of it: Intercis is not SOC 2 certified and no audit is underway.
We could not find a published number for how many teams can reconstruct what their agents did last week. Here is what a proxy log holds that a SIEM does not.
Here is what our own log records and never judges. Hosted MCP tool calls, observed, not governed.
The SOC is getting agents of its own. They hold the same credentials and make the same tool calls as the agents they were bought to watch.
We have the same problem inside our own product. The classifier fails open, and pages itself above 5%.
Build the governance layer or buy one. What it costs to keep a rule set current against a moving provider API, and what an auditor will ask you for either way.
If you build it, this is what you inherit. 3,802 proxy test cases and 448 more at the repository level.
In-process SDK enforcement against out-of-process proxy enforcement: where the guard runs, what it costs to deploy, and which bypass each one leaves open.
The cost on our side is real. We publish no latency figure, and a stream is buffered in full before it is judged.
What it is, what the four parts do, and the two questions that separate a governance tool from a dashboard.
The first of those two questions, answered on ours: what a deny does to the response.
The dates are publication dates and none is backdated. Most of these pages
were rebuilt on this template on 2026-09-12 and read against the repository the
same day; the ones edited since carry the day they were read, in the byline
and in the structured data, and no publication date moved. Every correction is
a quoted before and after with its reason beside it in
apps/site/scripts/apply-shell-articles.js.
Three rounds of that produced a list of corrected sentences, and a corrected
sentence is worth less than it looks: a claim we retired came back twice in new
words, and the version that survived longest was a rule count on a page nobody
had quoted. So the check is no longer a list of sentences. It is a list of
claims this repository cannot support, in
apps/site/scripts/claim-classes.js, and a page that makes one is
not written and does not pass the check. The classes cover traction, bypass,
certification, market size, numbers with no command behind them, features
nothing implements, cost-free framing and adjectives a reader should be the one
to award. Putting a claim back means editing that file, in a commit, with a
reason. That is the point.
Word counts and reading times come from the same script. It strips the markup,
drops the code blocks, counts what is left and rounds at 200 words a minute, then
prints the table. Run
node apps/site/scripts/apply-shell-articles.js --check and the
numbers above are what it prints; --check writes nothing, while the
same command without it rewrites all twenty-two pages. Measured 2026-09-18.
The T-numbers on this site come from Agentic AI Threats and Mitigations v1.1, published by the OWASP GenAI Security Project and read in April 2026. It is the only source on these pages that is not ours.
Intercis is a proxy that runs outside your agent process. Your agent's traffic to Anthropic or OpenAI goes through it, policy runs on the tool calls the model asks for, and once enforcement is on, a denied call is taken out of the response before your agent runtime can execute it.