MISSION-AWARE EXECUTION CONTROL

It knows if your agent is still yours.

The firewall for AI agents — a GPT-5.6 intent layer that catches hijacked agents static rules can't see.

the firewall IS GPT-5.6 judging GPT-5.6

Launch live console →Run the attack demo

PUBLIC, KEYLESS DEMO · REAL POLICY AND LEDGER PATH

01THE LAYER

MISSION-AWARE CONTROL PLANE

One layer between your agent and everything it can touch.

Every high-risk action — payments, email, data, APIs, shell — is judged against the mission before it executes.

02THE BLIND SPOT

THE ATTACK RULES CAN'T SEE

Rules see numbers. The firewall reads intent.

// payload: €300 gift cards at gift-card-store.examplepolicy floor: merchant_allowlist ... gift-card-store.example approved ✓policy floor: per_transaction_cap ... €300 ≤ €1,000 ✓policy floor: daily_budget ... €300 ≤ €10,000 ✓intent firewall (gpt-5.6): suspicious · confidence 0.84→ FINAL: HELD FOR APPROVAL

every rule green — only the intent layer sees it. This is the case that matters.

“The payment passes every numeric rule but does not serve the declared mission: personal gift cards fall outside approved API-credit purchasing.”

recorded run · reproducible in console →

03THE FAILURE MODE

Your agent follows instructions. All of them.

Agents read emails, webpages, invoices, and documents to decide what to do.

A poisoned document can redirect the agent without changing its permissions.

By the time it acts, every numeric rule can still be green.

Gartner predicts that by 2028, 1 in 4 enterprise breaches will be traced back to AI agent abuse — from both external and malicious internal actors.

— Gartner, 2025

ACTIONS TODAY—

THREATS BLOCKED—

PENDING—

AUDIT CHAIN—

pulled live from the running system · CONNECTING

04HOW IT WORKS

THE TWO JUDGES

Every action has to clear policy and intent.

01 / MISSION

Declare a mission

The agent registers its purpose. Every proposed action is judged against that declared mission.

set by the operator · every change is ledgered

02 / FUSION

Judged twice

A deterministic policy floor checks caps, allowlists, and integer cents. GPT-5.6 reads intent against the mission. If the model is unavailable, fusion fails closed.

deterministic floor + gpt-5.6 · fails closed

03 / EVIDENCE

Chained forever

Every decision is hash-chained with SHA-256. Historical tampering breaks the chain and is verifiable live.

break it yourself → open the consolehash-chained · break it yourself in the console

05POSITIONING

HONEST COMPARISON

Controls compose. Intent is the missing layer.

CAPABILITY	Spend management tools	Agent wallets	Deterministic kernels	AgentGuard
Spend caps & allowlists	FULL	FULL	FULL	PARTIAL
Human approval loop	FULL	PARTIAL	PARTIAL	FULL
Tamper-evident audit chain	PARTIAL	PARTIAL	PARTIAL	FULL
Reads intent vs a declared mission	NO	NO	PARTIAL	FULL
Catches attacks that pass every rule	NO	NO	NO	FULL
Fail-closed by design	PARTIAL	PARTIAL	PARTIAL	FULL
Plugs into any agent (MCP)	PARTIAL	PARTIAL	PARTIAL	FULL

Deterministic layers catch rule violations. AgentGuard catches betrayed intent — they compose, not compete.

AgentGuard does not hold funds or replace spend controls — it composes with them.

06OPEN EVIDENCE

VERIFY, DON'T TRUST

Every core claim is reproducible.

SOURCEGitHub repoRead the implementation →PROOFVERIFICATION.mdEvery claim → proof → real output SECURITYFinal security auditExposure and accepted risks →INTEGRATIONWorks with any MCP clientCodex CLI, Claude, ChatGPT developer mode — every agent action judged before it executes. Config in the console →

You can even tamper with the ledger yourself — the chain will catch you. → open the console

LOCAL / 60 SECONDSNo API key required

git clone https://github.com/doctormizio777777/agentguard.git
cd agentguard
docker compose up --build

BUILT WITH

Codex + GPT-5.6 · FastAPI · SQLite · Next.js · MCP

OpenAI Build Week 2026 entry