ParryAI is the control plane between your AI agents and everything they touch. Inspected against policy, enforced at the boundary, and written to an evidence ledger your auditors can read.
Shadow mode first. Nothing is blocked until you say so.Governed in five days.
The fastest way to lose a security programme is to become the thing standing between engineers and their work. ParryAI governs by tier. Almost everything runs untouched and recorded. A person is pulled in only where the action cannot be undone.
The agent proceeds. The action is inspected, scored, and written to the ledger. No latency budget spent on a human, because none is needed.
No interventionPolicy refuses or sanitizes inline, in the same call. The agent receives a structured refusal it can reason about and route around.
Machine speedProceeds with a caveat Plastron attaches to the record: low confidence, drift against baseline, unverified claim. Reviewed in aggregate, never in the path.
AsynchronousIrreversible, high blast radius, or regulated. The agent holds. A named human sees the exact change, decides, and their decision is signed into the ledger.
Human in the loopEscalation is defined by blast radius, not by suspicion. Destructive operations, writes to production, movement of funds, privilege changes, merges to a protected branch, regulated data crossing a jurisdiction, outbound communication above a threshold. Everything else runs at full speed.
You set the tiers. If a class of action stops earning a human, demote it, and the ledger records that you did, with who decided and when.
deploy-agent requests merge to main
DECISION IS WRITTEN TO THE LEDGER WITH YOUR IDENTITY ATTACHED
Enforcement without a record is a feature. Enforcement with a defensible, board-legible record is infrastructure. The module that does this is Plastron, and it turns every decision the plane makes into an artifact someone can be held to.
In a bout, the plastron is the padded layer worn under the jacket: the last thing between the blade and the body. This module is HDIPS. It sits between what a model produces and a human acting on it, and it is the only module whose job is the integrity of the decision itself rather than the safety of the request.
The weighted score the other four subsystems feed, and the number a decision is finally judged on before it is allowed to stand.
Ties an output to what happened downstream, so a bad decision is traceable to the action it actually caused rather than inferred after the fact.
Puts a claim to a structured challenge before it is permitted to stand as fact, which is where fabricated guidance is caught.
Signs every output so its origin can be proven and any tampering detected, without altering what the reader sees.
Tracks each agent against its own baseline and moves its trust as it drifts, so standing is earned continuously rather than granted once.
Acme Financial, all environments
01 AUG to 30 AUG 2026
| Day | Allowed | Flagged | Refused | Total |
|---|
Every refusal resolves to the layer that produced it and the policy it enforced.
Illustrative figures shown for layout. In a pilot these are your agents and your traffic.
Plastron is only as good as what it has to record. Six enforcement modules sit under the governance layer and feed it, each named for a movement of a fencing bout, because that is what defence at a boundary is: read the line, meet it, answer it.
The layered inspection stack, and the module every other one reports through. Heuristics, semantic and ML classifiers, embedding similarity, perplexity, and behavioural analysis each score every crossing, and the composite decides.
Policy enforcement in front of model and tool endpoints. Per-agent scopes, rate ceilings, and refusal semantics an agent can parse and route around rather than retry blindly.
Enforcement where the human works. The browser and desktop surfaces where staff paste, upload, and prompt against production data.
Egress inspection. Watches what leaves: exfiltration patterns, canary tokens, and encoded payloads on the way out.
The agent identity registry. Which agent, acting for whom, under which grant, resolved before the call is admitted.
The same enforcement contract carried out to devices and constrained runtimes at the far edge of the estate, where the network is unreliable and the decision has to hold locally. The boundary does not move because the hardware got smaller.
Most of the security teams we work with are one or two people carrying the whole function. The deployment is a fixed playbook, not a consulting engagement, and it starts by telling you what your agents are already doing.
Point agent traffic at the plane in observe only mode. Nothing is blocked. The ledger starts filling within the hour.
You get the inventory: which agents exist, what they touch, and what would have been refused. Usually the first surprise of the engagement.
Agree which actions are irreversible enough to earn a human. Everything else is left to run. Enforcement goes on.
A signed statement of every agent action, enforcement decision, and human approval for the period, mapped to your control framework.
A governance claim is worth what its artifacts are worth. Every control below resolves to a specific enforcement primitive and a specific measurement artifact in the repository.
| Regulatory regime | Controls | Fully covered | Partial | Gapped |
|---|---|---|---|---|
| EU AI Act, Article 53 | 6 | 5 | 1 | 0 |
| NIST AI RMF 2.0 | 7 | 7 | 0 | 0 |
| SOC 2 AI Trust Services | 6 | 5 | 1 | 0 |
| HIPAA AI Guidance | 6 | 4 | 2 | 0 |
| Total | 25 | 19 | 6 | 0 |
Partial coverage is stated as partial. Each of the six carries a documented path to full coverage rather than an assertion. Internal adversarial testing report available under NDA.
Independent layers, scored together. A single evasion technique has to defeat all of them, not one.
Exercised against 1,482 adversarial examples drawn from OWASP LLM Top 10, OWASP Agents Top 10, MITRE ATLAS, StrongREJECT, HaluEval, FActScore, HaluBench, PromptBench, and internal corpora. Dataset hashes and run manifests are committed alongside the code.
Drop it in front of the model call you already make. Every call returns a decision, the layer that produced it, the tier it resolved to, and a ledger reference. Run enforcing from day one, or shadow it against production traffic and read the ledger before you turn enforcement on.
// every crossing goes through the planeconst v = await parry.inspect({agent: "deploy-agent", actor: session.userId, action: "vcs.merge", target: "acme/payments-api#main", payload: diff,});if (v.tier === "escalated") {// a named human was paged; the agent holdsawait v.awaitDecision();}if (!v.allowed) return v.refusal;await vcs.merge(v.payload); // evd_01J8F2K
Pilots start in shadow mode against your real traffic and block nothing until you say so. At the end you get the ledger, the control mapping, and a straight answer about what your agents have actually been doing.
Or write to info@parryai.io