When we launched Draco, we focused on the agents running in cloud and server-side environments. Since then, a second front has opened. AI coding agents, browser-based assistants, and locally running models now execute directly on enterprise-managed laptops (endpoints), where a growing share of enterprise AI activity happens and where almost none of it is governed.
That is why we are introducing Aquila, an endpoint AI governance suite that extends the same runtime visibility and enforcement we built for cloud agents to endpoint devices. Aquila evaluates prompts, tool calls, and uploads on the endpoint itself, before they execute.
Why We Built This
One of the biggest challenges with AI agents in enterprises is managing their growing presence across the organization, particularly on company devices. Engineers are using AI coding agents to build software. Employees are installing AI browser extensions on their work devices to help with everyday tasks. Across the organization, these autonomous agents are being connected to internal company data in order to execute end-to-end workflows.
Now multiply these agents across multiple devices for each of tens of thousands of employees. It's hard to imagine just how many ungoverned agents exist across a modern enterprise ecosystem.
When humans interact with AI, we often let our guard down. We send hundreds of prompts a day, drag files directly from company systems into chat windows, and click “Allow” on an agent’s actions without thinking twice.
That casual behavior can create serious security risks. 38% of workers share sensitive data with AI tools without their employer’s knowledge, and 66% have used unauthorized AI at work. In those moments, it’s easy to forget that the data flowing through these interactions can include source code, credentials, customer information, and regulated data.
Meanwhile, the agent is executing shell commands, writing to local files, and pushing changes to remote repositories. Almost none of that activity is visible to traditional security tooling. That's what makes shadow AI on the endpoint one of the fastest-growing enterprise exposures.
Our Solution - Three Endpoint Enforcement Points
With Aquila, every prompt, action, and tool call is captured and evaluated on the device before it leaves the endpoint. Prompts are evaluated before they're submitted. Tool calls are evaluated before they're executed. If someone uploads a document containing source code, credentials, customer records, or other sensitive data, Aquila can inspect it and flag it before anything is transmitted.
Built for speed, evaluations run locally in milliseconds. The inline policy engine is deterministic, so raw endpoint content never has to be sent to an LLM in the hot path, and enforcing action never depends on a network round trip.
The platform also provides real-time visibility into agent behavior. Activity on the device is captured as sessions containing every prompt, tool invocation, and action, all attributed to both the user and the endpoint. Those sessions feed the same Risk Score and audit trail as cloud-based agents, so governance works across both environments through a single record.
The suite is made up of three enforcement points:
Aquila Code governs AI coding agents on the device. It evaluates tool calls before they execute, stopping destructive shell commands writes to protected paths or pushes to production branches. The goal is to decrease risk and increase efficiency by discovering them at the point of invocation instead of during code review.
Aquila Browser governs AI browser extensions and web AI applications. It evaluates prompt text and upload metadata, protecting the place where source code, credentials, and regulated data most commonly leave managed devices. If an interaction violates a locally enforced policy – for example, by attempting to send customer PII in a chat – it is flagged for review before the data is transmitted.
Aquila Local Gateway sits between local AI tools and their destinations. It sees where AI requests are headed and applies your organization's policies to desktop AI apps, locally hosted models, and on-machine MCP servers.
What you gain with Aquila
With Aquila, you can:
- Discover every AI tool in use across managed endpoints, including devices used by remote and work-from-home employees.
- Prevent sensitive data exposure by stopping risky prompts and file uploads before they reach external AI models.
- Block risky or destructive AI tool calls as they happen.
- Track AI usage and costs by user, device, model, and application.
Getting started
Aquila is available today for enterprise customers. If you are managing AI adoption across a large endpoint fleet, we would love to show you what is possible.
Learn more at www.alterion.ai/platform/aquila, or reach out at info@alterion.ai.