It mediates every action an autonomous agent takes, enforces identity-bound guardrails, and emits signed, hash-chained evidence — so you can trust the evidence without trusting the code that produced it.
AI agents no longer just generate answers. They call tools, execute workflows, move data, trigger automation, and make decisions across enterprise systems. Traditional logs show infrastructure events — but they miss agent intent, tool reasoning, policy violations, prompt-injection attempts, and unsafe action chains. That loop is the entire attack surface, and it cannot be secured from inside the agent, because the agent is the component being manipulated.
Captures agent plans, tool calls, prompts, responses, and outcomes as first-class telemetry — every meaningful step becomes observable and reviewable.
An identity-bound, default-deny tool policy blocks, warns, or escalates risky actions — with argument constraints and human-in-the-loop on irreversible verbs.
A six-pass normalization and fail-closed detection engine identifies injection, secrets, PII, and tool-poisoning attempts in untrusted content — in both directions.
Every decision produces an Ed25519-signed, hash-chained receipt. Reviews, investigations, and compliance draw from a tamper-evident ledger, not best-effort logs.
Runs on a laptop for evaluation and ships as a hardened, cosign-signed container with a segregated control plane and probe-gated network topology.
Custom detection logic and signed policy packs, with severity levels and a human-gated learning loop that can only ever tighten the gate — never loosen it.
SIEMs, APM tools, endpoint security, and cloud logs are essential — but they were not designed to understand agent-native behavior. They can tell you that a request happened. AgentLighthouse helps explain why the agent made it, what influenced it, what policy applied, and whether the action should have been allowed at all.
Seven layers (L0–L6), operated as four gates, with a control plane physically segregated from the agent network. Everything fails closed; every decision is receipted.
Egress choke-point, proxy modes, DNS pinning, SSRF controls, MCP / A2A wrapping.
Six-pass normalization, injection, DLP / secrets, PII, entropy, rate and budget.
Identity-bound tool policy, argument constraints, chain detection, HITL, taint, memory guard.
Signed receipts, ledger and mirror, kill switch, RBAC, config validation, dashboard.
Read left to right: a tool call, fetch, MCP or A2A request must clear the Edge, Content and Action gates before it reaches the outside world. Any gate can allow, challenge, or block — and every outcome is written to a signed receipt.
Three isolated networks. The untrusted agent network holds no route to the privileged control plane; all traffic must pass through the al-core mediator on the data plane, which scans it in both directions.
One mediated request in time order — identity and egress checks at the Edge, six-pass normalization and scanning in Content, policy and human-in-the-loop at the Action gate, then forwarding — with a signed receipt written to the ledger for every verdict, including fail-closed blocks.
Six actor classes across four trust zones, from the untrusted agent runtime through the trusted al-core mediator to the append-only, signed audit ledger that serves as the source of truth.
al — core data + control planeal-verify — standalone verifieral-gov — multi-org governanceEvery meaningful agent step becomes an observable, reviewable, and enforceable event. Rules are human-readable and evaluated at runtime — before or during execution.
rule: block_external_secret_leak
when:
event: agent.tool.requested
destination: external
payload_contains: secret_like_pattern
then: { action: deny, severity: critical }
rule: require_human_approval_for_delete
when:
tool_action: delete
environment: production
then: { action: require_approval, severity: high }
rule: detect_untrusted_instruction_override
when:
external_context_contains: instruction_override
agent_plan_changes_after_context: true
then: { action: alert, severity: high }
Three shipped profiles, validated fail-closed with al check. Secrets never live in YAML — env only. The single most important knob is gateway.allow_hosts: an empty list is default-deny.
Observe & record; never break workflows. The only profile where a protection may be disabled. Never in production.
Default. All protections on, block-wins precedence. 10 rps/domain, 5 MiB fetch cap, 3 redirects.
HTTPS only (443), 1 MiB cap, 1 redirect, 5 rps. No permissive settings allowed.
uv run al check --config configs/strict.yaml → config OK # non-zero exit on ANY error uv run al scan "ignore all previous instructions" → block · INJECTION_BLOCKED · exit 3 uv run al scan "AKIAIOSFODNN7EXAMPLE" → strip · secret redacted · exit 2
Understand agent actions before they affect systems.
Connect agent behavior to incidents and reliability signals.
Enforce deployment and runtime guardrails in CI/CD.
Detect prompt injection, data exposure, and unsafe tool use.
Standardize agent telemetry across teams.
Debug, evaluate, and improve agent workflows.
Three supported paths — native (uv), Docker Compose with the sealed three-network topology, and the probe-gated one-command pilot install. Two boot probes gate every compose up: one proves the agent network has no out-of-band egress, the other proves it has no route to the control plane. If either fails, nothing starts.
no-new-privileges, cap_drop ALL, read-only rootfs, non-root uid 10001 — pinned by tests/test_hardening.py, with an optional gVisor profile. Kubernetes manifests are deliberately not shipped; the compose topology is the reference for any orchestration you build.See every meaningful agent step across tools, memory, and external systems.
Prevent unsafe actions before they reach sensitive systems.
Detect untrusted instructions and suspicious behavioral changes.
Reconstruct what an agent saw, planned, decided, and executed.
Produce reviewable, signed trails for internal governance and audit readiness.
Compare agent behavior across versions, prompts, and rule packs.
Every mapping ships in-repo as a checkable document, and every finding a receipt carries is tagged with its OWASP category and MITRE technique — so coverage is verifiable in your SIEM, not asserted on a slide.
Like open efforts such as Agent Threat Rules, AgentLighthouse believes agent security must be open, mapped, and checkable.
A rule standard tells you what fired. A mediation plane decides what happens next — and proves it.
RFC 8785 (JCS) canonicalized, SHA-256 hash-chained to its predecessor, Ed25519-signed by the mediator. The spec (spec/receipt-v1.md) and JSON Schema are published MIT-first — third parties can produce and verify receipts without this runtime.
al-verify data/ledger.jsonl \
--pubkey keys/mediator_ed25519.pub
→ chain of 11 receipt(s) verified from genesis OK
Multi-tenancy, RBAC, budgets, and signed posture attestations live in a separate governance layer (al-gov). The open core never imports it — a test enforces the dependency direction — and tenant isolation is enforced in core/, so governance can only narrow what a caller sees.
Org slugs match each agent's SPIFFE identity — spiffe://<org>/agent/<name>. Tenancy follows identity, not configuration.
admin · operator · viewer plus cross-org fleet admins. Tokens are stored hashed and shown exactly once.
A signed attestation carries a computed Agent Evidence Level (AEL 0–3) — derived from evidence, never asserted. Enforcement cannot be claimed from audit mode. Verifiable with al-verify.
Per-user virtual LLM keys (alk_…) with request/token budgets; al-gov cost attributes spend per key, per org.
Detection standards like ATR publish recall/precision on public corpora — the right trend for rule packs. A mediation plane is evaluated differently: every security invariant has a test proving it, demos double as acceptance tests, and the release gate is binary. No published benchmark or ROI figures exist for this repo; evaluate against your own workload in audit mode.
.env; evidence append-only and signedCompliance mappings ship in-repo and defer to the product's core output — signed evidence. An auditor verifies any receipt or the whole chain with the standalone verifier instead of taking the runtime's word for it.
ghcr.io, cosign-signed keyless (OIDC) by digest, not tag, with an SPDX SBOM attestation attached. CI runs the full suite plus all three demos on every push — the release gate is part of the pipeline, not a ceremony.cosign verify <image>
cosign verify-attestation --type spdxjson <image>
→ signature + SBOM verified against the digest
al export as threat.technique.id (ECS) — a SOC pivots on agent incidents exactly as on any other telemetry source.These mappings are engineering planning aids, not legal opinions or certifications. They are checkable rather than aspirational because the core output is signed evidence — the mappings defer to the repo's master honesty statement.
Capability compounds left to right: what ships today already mediates and receipts every agent action; each phase widens what organizations can govern with it.
living roadmap · directional, drawn from documented gaps · nothing is a dated commitment · hover a phase for depth
{{ activeRoadDetail }}
org benefit → {{ activeRoadBenefit }}
AgentLighthouse is built in the open so operators, engineers, and security teams can inspect the behavior model, tune policies, contribute integrations, and adapt the runtime to their own environments. The receipt format is a published specification and the verifier is standalone — you can trust the evidence without trusting the code that produced it.
An in-browser simulation of the shipped regex/heuristic scanners and the default-deny policy — same verdicts and exit codes, no server. Real enforcement runs in al-core; install it with one command in the Quickstart.
Move from experimental agents to observable, governed, and production-ready agentic systems.