Product · Regulated teams already running AI agents in production.
Your policy pack writes the rules files for Claude Code, Copilot and Cursor from one source. Every agent works for a named person, and every change it makes still needs a human approval.
- The problem
- Each agent vendor has its own controls, each can be bypassed locally, and nothing ties an agent’s action to a person or a change.
- What it does
- Generates each tool’s configuration from one pack, routes agents through a gateway under a key tied to a named human, and backs every local rule with the same server-side gates people face.
- The result
- Your teams use agents at full speed, and you can show who each agent worked for, what it did and who approved the result.
One source: your policy pack
pack: kestrel-standard@v7
protected_paths:
- src/payments/**
- db/migrations/**
- .github/workflows/**
block:
- command: "rm -rf"
- command: "terraform apply"
when: env == production
- secret_patterns: default
- confidential_terms: kestrel-terms
ask:
- dependency_major_bump
agents:
production_credentials: never
approve_changes: never
mcp_allowlist: pinnedGenerated for each agent
/etc/claude-code/managed-settings.json
{
"allowManagedHooksOnly": true,
"permissions": {
"deny": ["Bash(rm -rf:*)", "Bash(terraform apply:*)"],
"ask": ["Edit(src/payments/**)", "Edit(db/migrations/**)"]
},
"hooks": {
"PreToolUse": [{ "matcher": "*",
"hooks": [{ "type": "command",
"command": "aspian guard --pack kestrel-standard@v7" }] }]
},
"enableAllProjectMcpServers": false
}Local guard, server-side backstop
Hooks decide allow, block or ask as the agent works. Local hooks can be bypassed, so the gates that matter sit on the server.
- Destructive commands against anything labelled production are blocked outright.
- Secrets are used through handles and never echoed back into an agent’s context.
- Commits from an unmanaged device are marked as such, and still pass every gate.
Taint, for prompt injection
An agent session that read untrusted content, such as web pages, issues or MCP data, is tainted. Anything risky it plans needs a person’s passkey, and the taint never lapses on its own.
The MCP gateway
Agents connect through Aspian’s MCP gateway. Servers not on your allowlist are refused, and the allowlist is pinned to versions with known hashes.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.