Ethosure Software
AI stealing control?
Try stealing it back!
Your coding agents already write files, run shell commands and touch production. Ethosure sits in that action path, checks each step against your own policy, and keeps the proof. It runs on your infrastructure. Nothing phones home.
The problem, plainly
Agents developed intent. Your controls still assume they only have opinions.
Coverage at the edges of the AI lifecycle is decent. Governance platforms record what the policy says. Scanners test code before release. SIEM tells you what happened afterwards. The hole is in the middle, at the second an agent acts, and it is a hole the current toolkit was never built to fill, as we set out in the piece on the missing enforcement layer.
That gap is no longer theoretical. Our incident tracker records publicly disclosed cases between March and August 2026 in which autonomous agents escaped test environments, exposed enterprise data, forged reviewer identities and coordinated with each other through shared repositories. In one case an agent held valid credentials and passed every identity check, so no traditional authentication control fired at all.
An agent with valid credentials is not an intruder. It is an insider with no employment contract, no performance review, and a very fast keyboard.
Why now
The volume problem arrives before the control does
IDC projects more than one billion active AI agents worldwide by 2029, roughly forty times the 2025 figure, and notes that agents, unlike earlier AI systems, independently execute actions that can lead to data exfiltration, privilege escalation and unauthorized system access.1 IDC’s account of RSAC 2026 is that agent proliferation is already outpacing enterprise visibility and governance, and that agentic adoption should be treated as a governance and operating-model question rather than a tooling decision.2
You do not need a forecast to test the claim locally. Count the coding assistants in use across your teams, count how many can write to a repository or run a command with no human keystroke in between, then ask who signed off on that number. It is usually larger than anyone expected and rarely written down.
The failure modes are already public. Our incident tracker groups the 2026 disclosures by root cause: agent-to-agent coordination, sandbox escape, confused deputy, credential misuse, privilege escalation, unauthorized system access and unsanctioned action under a fake identity. A short, finite list, which is the good news. Each pattern maps to a policy family that constrains it at the moment of action.
What you get
The benefits, in business terms
One control point
Every agent action that touches a governed repository or toolchain runs through the same five steps: intercept, evaluate, decide, sandbox, record. No exceptions, no side channel.
Decisions you can defend
Policy is evaluated with CEL, a deterministic expression language. Same action, same policy, same answer every time. Nothing probabilistic sits in the decision path.
Fail closed, by design
Malformed commands are denied. Indeterminate evaluations block. Skipping a hook with --no-verify counts as an enforcement failure, not a workflow quirk.
Evidence as a by-product
An append-only ledger records the action, the policy that fired, the disposition and the remediation, in SARIF, JSON and TOON. Reports map to NIST AI RMF, ISO/IEC 42001 and EU AI Act documentation duties.
Your data stays yours
No hosted backend, no cloud dependency, no telemetry to us. Enforcement, policy evaluation and evidence storage all sit inside your environment, including air-gapped ones.
It pays some of its own rent
Blocking non-compliant work before it executes removes rework loops and redundant context. Our illustrative model puts avoidable agent token waste at roughly 20 to 30 percent of spend, and assumes recovering about half of it.
Full workings, including the assumptions we would not defend as benchmarks, are in the token-spend analysis.
Not another AI
Ethosure is the answer to rogue AI, not more of it
This matters more than any feature list. Ethosure does not add a model to your estate. There is no classifier making a judgement call about whether a command looks risky, and no second AI you then have to govern. Facts are gathered from the actual command, the file paths and the abstract syntax tree of the code being written, parsed with Tree-sitter. Policy is compiled. Evaluation is pure and side-effect free. The result is one of four dispositions: allow, transform, escalate, block.
Probabilistic components exist for code search. They are explicitly barred from control decisions. That distinction is what lets you hand a regulator a reproducible answer rather than a confidence score, and it is the reason we block when unsure.
Fit with your stack
What a CISO runs today, and what still is not covered
Nothing below gets replaced. Ethosure slots underneath your governance system of record and beside your existing controls, covering the one moment they were not designed for.
| What you already run | What it does well | What it cannot do at the moment of action |
|---|---|---|
| AI governance platform | Defines policy, classifies systems, tracks posture | Describes what the policy is. It does not enforce it at runtime. |
| Guardrail and prompt filters | Screens content, prompt injection, sensitive data | Uses probabilistic classifiers on text. It does not evaluate a structured action such as a shell command or a file write. |
| SAST, DAST, SCA scanners | Finds defects before release | Runs before or after the fact, not in the agent’s action path. |
| WAF, API gateway, RASP | Protects conventional request traffic | Has no model for an autonomous agent’s action sequence inside a development environment. |
| SIEM and monitoring | Aggregates, correlates, alerts | Retrospective by design. It tells you what happened, not what is happening now. |
| IAM and PAM | Authenticates and brokers privilege | An agent with a valid token passes. Intent is not authenticated. |
| Ethosure | Deterministic enforcement plus tamper-evident evidence in the action path | This is the layer. It complements the rows above rather than competing with them. |
Why run it alongside everything else, now, rather than waiting for the market to consolidate? Because your agent fleet is growing this quarter, the EU AI Act became enforceable in August 2026 with Article 99 penalties up to 35 million euros or 7 percent of global turnover, and OSFI E-23 carries a compliance deadline of 1 May 2027. Evidence cannot be backfilled. Either the control was in the path when the action happened, or it was not.
Sovereignty
Where does your AI governance data live?
With most tooling the honest answer involves somebody else’s cloud. With Ethosure the decision to allow or block never leaves your estate: CEL evaluators are local Go binaries, the compiled policy bundle sits in your repository, the ledger is a JSONL file in your own storage, and the sandbox uses Linux namespaces, Landlock and cgroups rather than a management plane. Enforcement works with no network access at all. Residency questions under GDPR, PIPEDA, sector rules and customer contracts get a short answer, which is the whole point of running local first.
The model can still run wherever you buy it. The governance layer stays home.
Boards are already leaning this way. Omdia reports that 64 percent of enterprises are in favour or strongly in favour of sovereign AI, with 37 percent treating AI infrastructure localization as a resilience measure against economic and political uncertainty.3 Omdia also observes that full sovereignty across an entire AI stack is impractical, so the realistic move is agency over selected layers. Governance is the cheapest layer to keep in house and the most awkward one to explain away when somebody asks where the decisions were made.
Two audiences, one control
Why developers have begun to embrace this
- Friction moves earlier. Agents can ask the local MCP server “is this allowed?” through
policy_check_commandandpolicy_check_editbefore running anything, so the answer arrives before the work, not in code review. - Blocks come with instructions. Every denial emits the policy ID, the principle behind it, a specific fix and the exact command to re-run.
- Less rework. Non-compliant changes never reach CI, which is where rework loops usually start.
- No new console to live in. Git hooks, agent tool-use hooks, an MCP proxy and your existing CI, with findings uploaded as SARIF.
Why risk and audit teams sleep better
- A control, not a log. Auditors want something in the path that can allow, redirect or stop an action, plus evidence it was live at the time. A policy spreadsheet meets neither test. A post-hoc log meets only the second.
- Append-only records. The JSONL ledger is the authoritative copy and the DuckDB index rebuilds from it, so any discrepancy is detectable.
- Framework mapping already done. Evidence maps to NIST AI RMF, ISO/IEC 42001 and EU AI Act technical documentation obligations.
- Audit prep in hours. The evidence is a by-product of operating, not a project that starts when the request letter arrives. See the auditor-facing walkthrough.
- Narrow first step. One agent, one repository, on your own infrastructure. That is a contained pilot, not a platform migration.
Ask your team the uncomfortable question: if a regulator asked today for proof that every AI coding agent followed policy at runtime, could you produce it? The policy checklist takes two minutes. Any “no” is the reason this page exists.
Start here
See it running on your own code
Thirty minutes, screen shared, one agent under enforcement, real blocks and a real ledger. No slideware unless you ask for it.
Prefer to read first
Take the AI Governance Kit
Eighteen editable files: business case, project plan, discovery workbook, stakeholder deck, baseline report template, board and auditor memos, a role-based training plan and a sample policy and audit matrix, plus vertical variants for finance, healthcare, retail, manufacturing, technology, professional services and smaller organizations. It establishes a baseline. It is not a compliance certification, and we say so in the disclaimer. Details are on the kit page.
Not ready for either
Just get the useful parts by email
Roughly monthly. New incidents with the policy family that would have applied, plus explainers such as what CEL actually is and how the evidence ledger holds up. Unsubscribe in one click.
More depth: The Software 路
AI Governance Primer 路
Ethosure Incident Tracker 路
one control point, five steps 路
supply-chain trust 路
all articles 路
our pledge 路
contact us.
Would rather not fill in anything? The contact page creates a plain email and doesn’t add you to a list.
References. 1. IDC, Operationalizing Trust for Agentic AI in the Enterprise, 8 February 2026 (doc #lcUS54279526). 2. IDC, RSAC 2026: Agentic AI, Cyber-Resilience, and the Reinvention of Security Services, April 2026 (doc #US53982926). 3. Omdia, The Omdia Sovereign AI Primer, 2026, reporting the Omdia 2025 AI Market Maturity Survey (n=448). Regulatory dates are drawn from the EU AI Act, including Article 99, and OSFI Guideline E-23, published 11 September 2025 with a 1 May 2027 compliance deadline. Product claims and cost figures come from Ethosure’s own published research and documentation, linked throughout; cost figures are illustrative models rather than benchmarks or guarantees.
Third-party research is cited here for factual reference only. IDC, Omdia and any other named firms have not reviewed, tested, endorsed or expressed any opinion on Ethosure, its products or its claims, and no such endorsement should be inferred. All quoted material remains the copyright and property of its respective owners, and all trademarks belong to their respective holders.
