Pre-execution control for AI agents
AI agents are approving their own actions.
The model proposes. The gate authorises.
Before AI accesses customer data, issues a refund, updates a system, exports records, changes a file, or calls a connected tool, Sector8 returns ALLOW or DENY. The agent does not approve itself.
Same gate for coding agents, internal copilots, and customer-facing tools. See what else it covers.
{
"tool_name": "Bash",
"arguments": {
"command": "cat .env"
},
"caller_id": "claude-code",
"session_id": "eng-session-07",
"operation": "read"
}Sample artifact. Field names match the evaluate contract. This denial is SENSITIVE_PATH_BLOCKED.
The gap
Your agents are proposing and approving in the same breath.
An agent decides it needs to read a file, run a command, call a tool, or move money. Then it does it. The thing that decided is the thing that authorised. No other system in your estate works that way.
Three consequences you already recognise
The agent has your permissions, not its own.
It runs with a service account scoped for a human doing a whole job, not for one action. Every tool it can reach, it can use.
An injected instruction becomes a real action.
You cannot reliably detect a prompt injection — that is a classifier, and classifiers are probabilistic. But an injected instruction still has to become a tool call before it does damage. That is the point where it can be refused rather than detected.
You find out from the logs.
The refund is issued. The export has left. The deploy is live. Detection tells you what happened; it does not decide whether it should have run.
And the part most teams cannot answer: what have your agents already tried? Not what they were allowed to do — what they attempted, in the last two weeks, that nobody saw.
Shadow mode
What your agents already tried
Two weeks. Enforcement off. Nothing is blocked. Sector8 still evaluates every proposed action and records what it would have returned: ALLOW or DENY. You leave with a finding, then you choose which controls to turn on.
Sample decision tape. Not a customer report.
- Evaluated
- 6
- Would allow
- 4
- Would deny
- 2
Would-have tape
enforcement off
- 00:02ALLOW
support-assistant / crm
API · CRM lookup
within policy
- 00:08ALLOW
finance-copilot / ap
API · invoice status
within policy
- 00:14ALLOW
claude-code / checkout-svc
Bash · echo hello
within policy
- 00:19ALLOW
internal-copilot / hr
API · own leave record
within policy
- 00:24DENY
support-agent / billing
API · customer record
- 00:31DENY
claude-code / checkout-svc
Bash · cat .env
Most rows would have been allowed. The denials are a wrong-account customer record and a .env read — public codes, same evaluate contract.
How it works
Propose. Decide. Prove.
We do not try to govern what the model thinks. We govern what it is allowed to do.
1
Propose
The agent emits a tool call. Before execution, Sector8 receives the proposed action.
2
Decide
ALLOW or DENY. If the gate cannot allow the action safely, it denies. No model judges another model.
3
Prove
Reason code, decision trace ID, evidence hash, and policy version. Allows are recorded too.
Why pre-execution
After the fact is too late
- Sector8 gate. Before the action. The side effect has not started.
- Output filters. After the model has already seen the input.
- SIEM / DLP / logs. After data or the action may already have moved.
Determinism
A control you can test
Fire the same attack at the same policy a thousand times and you get the same DENY a thousand times, each with its own decision record.
If it is not reproducible, it is not a control.
Scope
Questions before a pilot
Classification can be one check. The control is the admission decision — ALLOW or DENY. Not a GDPR certificate.
- How is this different from filters or gateways?
- Filters act on text. Gateways act on which tools exist. Sector8 decides whether a specific proposed action may execute, before the side effect starts.
- What about high-risk or uncertain actions?
- REST evaluate returns ALLOW or DENY. If the action cannot be allowed safely, it is denied. On the MCP connector path, a borderline action can be held for a human; if nobody answers, it is denied.