Every agent under one policy. Every action on the record.
CortexHub decides what each agent may do before it does it, stops agents that misbehave automatically, and turns everything that happened into evidence your auditor can verify. One set of rules for Co-workers, organisation agents and external agents like Claude, ChatGPT and Copilot.
Every tool call gets a decision before it runs.
Policies are set per team and per tool. Reads can flow, writes can wait for a person, destructive actions can be blocked, and anything with no matching policy is denied by default.
- Least privilege per teamEach team sees only the tools it was given, and each tool is split into read, write and destructive actions.
- Approvals where people workRisky actions wait for a person in the app, on mobile or in Slack, with the reason the agent gave.
- Block by defaultA call no policy covers is refused. Nothing is allowed by accident.
- 1IdentityWhich agent, acting for whom
- 2PolicyAllowed for this agent, tool and data?
- 3Content safetyPrompt injection and sensitive data
- 4ApprovalA person decides when the rule says so
- 5AuditTamper-evident record of the decision
GitHubRead pull requestAllowedGitHubMerge to mainNeeds approval
SlackPost to #customersNeeds approval
NotionUpdate project pageAllowed
SalesforceDelete accountBlocked
StripeIssue large refundNeeds approvalWhat happens when something goes wrong.
Four real situations, played out the way CortexHub handles them. Every guard acts in the path of the agent, applies to every kind of agent, and opens a risk signal that says what happened, why it was a risk and what was done about it.
A threatening request is stopped before any model sees it
- A member types a requestScreening
"Write to the supplier and say we know where their staff live unless they drop the price by Friday."
Stops agents before damage, not after.
Every guard acts in the execution path and applies to every agent: Co-workers, organisation agents, and external agents connected through the gateway or the SDK. Each trip opens a risk signal your team can see.
Runaway-loop guard
A turn that keeps reasoning without finishing is halted at its step limit, and the agent is paused with the reason recorded.
Denial-spike breaker
An agent that keeps hitting denied actions (20 in 15 minutes by default) is paused automatically.
Rate limits
A flood of calls is refused at the platform floor and the agent is paused, so a fault or an attack cannot overwhelm your systems.
Approval breaker
Three refused approvals in 15 minutes ends the session, so an agent cannot keep asking until someone clicks yes.
Spend caps
Daily, weekly and monthly budgets per agent, enforced before the next call, with alerts at 80% and a clean stop at 100%.
Kill switch
Pause any agent instantly. A paused agent is refused on every request, including through Claude or ChatGPT.
Prompt-injection defence
Everything a tool returns is fenced as data. After untrusted content, sending to a destination nobody named needs a person.
Content moderation
Harmful requests are screened on input in every chat surface, with a platform floor no organisation can switch off.
Show your auditor that every agent follows the rules.
CortexHub measures eight readiness dimensions across every agent and maps them to the frameworks your auditors use. Four are guaranteed by the platform; four depend on how you configure it, and CortexHub tells you exactly where you stand.
| Readiness dimension | SOC 2 controls |
|---|---|
| Every action authorizedEvery call passes policy before it reaches a tool.Guaranteed by the platform | CC5.2CC5.3CC6.1 |
| Tamper-evident audit trailSigned, hash-chained records that verify offline.Guaranteed by the platform | CC4.1CC7.2CC7.3 |
| Cryptographic attributionEach record is signed for the agent and person who acted.Guaranteed by the platform | CC6.1CC6.2 |
| Full activity telemetryEvery governed action leaves a queryable record, exportable over OpenTelemetry.Guaranteed by the platform | CC7.2 |
| Human approval on high-risk actionsDestructive or sensitive actions wait for a person.You configure | CC7.2CC7.3 |
| Least-privilege accessEach team reaches only the tools and actions it needs.You configure | CC6.1CC6.3 |
| Prompt-injection defenceUntrusted content cannot trigger risky actions.You configure | CC3.2CC7.2 |
| Sensitive-data protectionPersonal and secret data is redacted before it is stored.You configure | C1.1 |
Show your board every agent is under control.
See policies, guardrails and framework readiness on your own agents in a 30-minute demo.