Platform
A control plane, not a collection of controls.
Ten modules that share one identity model, one policy set, and one record. You adopt them in the order your risk demands — but you never integrate the same agent twice.
The decision path
One request path. Eight questions. Every call.
Can this execute?
The call is decoded to a canonical form and evaluated against the policy set before any side effect occurs.
Coverage
Everywhere your agents already run
Developer machines
Coding agents in your editor — every tool call, file read, and outbound request
A process an agent spawns entirely outside the governed runtime is reported as uncovered rather than silently missed.
Servers and containers
Agents running in your own infrastructure, including scheduled and event-driven runs
Requires the workload to start under Cirvix. Discovery flags anything that does not.
Kubernetes
Cluster-wide coverage with the deepest available enforcement on Linux hosts
Deepest mode is Linux-only; other platforms run the standard coverage.
CI and pipelines
Policy changes checked before merge, evaluated exactly as they will be at runtime
Predicts behaviour on traffic already seen, not on traffic you have not.
Coverage is reported, not assumed. The console shows which of your hosts are governed and which are not, so the number you report upward is one you can defend. The specific enforcement architecture is covered under NDA in a technical review — ask us.
Modules
The ten stages
Enforce
Decide whether a call may happen at all — and on whose authority.
- 01
Runtime Security
Cirvix sits between the agent and the tool. Every call is parsed, normalized, and checked against the policy set before any side effect occurs. The agent receives a structured refusal it can reason about, not a crash.
- 02
Policy Engine
Authorization is an ordered set of JSON rules evaluated by a deterministic engine: forbid always wins, a hold outranks a permit, and anything unmatched is denied. Rules are versioned, diffable, and evaluated identically in the CLI, in CI, and at runtime.
- 03
Agent Identity
Every agent gets a verifiable identity bound to the workload it runs as, the human or service that owns it, and the scope it was issued. Credentials are short-lived and attested, so a leaked token is a narrow, expiring problem.
- 04
Secrets
Agents never receive secret material. They receive an opaque handle, and Cirvix substitutes the real value into the outbound request at the moment of use — after policy has authorized that specific destination.
Broker
Carry the call to the thing it is calling, narrowing scope on the way.
- 05
Human Approval
When policy resolves to a hold, the call pauses and a person is asked. The request shows exactly what will happen, in what environment, on whose behalf. Approve or deny, and the agent continues or re-plans.
- 06
MCP Gateway
Every Model Context Protocol server an agent can reach is registered, versioned, and inspected. Tool definitions are pinned, so a server that changes what a tool does cannot silently change what your agents are able to do.
- 07
A2A Gateway
When one agent calls another, the caller's identity, scope, and approval context travel with the request and can only narrow. A sub-agent cannot acquire authority its caller never had.
Observe
Record what happened, in a form that survives scrutiny.
- 08
Runtime Observability
Every run is a graph you can open: the plan, each tool call, each decision, each latency, each result. Replay reconstructs a run from its recorded decisions so you can see precisely what happened and test what a different policy would have done.
- 09
Audit
Every decision is written to an append-only log where each entry commits to the one before it. Periodic checkpoints are published, so a record cannot be altered or removed after the fact without the chain failing verification.
- 10
Analytics
What agents exist, who owns them, what they touch, how often they are refused, which models and tools they consume, and what it costs. The inventory is built from observed traffic, not from a spreadsheet someone maintains.
Platform
See it decide.
The console runs on synthetic traffic and needs no signup. Step through executions, open a policy, approve a held deploy.
Cirvix AgentControl is in private beta. Pricing is published and plans are not yet chargeable — early access confirms your place and we will tell you before anything bills.