No. Alterion deploys lightweight, runtime-level sensors across your infrastructure—monitoring network flows, container behavior, endpoint activity, and application logs—to build a continuously updated map of every agent and their behaviors. There are no code changes, no SDK integrations, and no modifications to how your agents are built or deployed.

Alterion supports agents deployed on any cloud including AWS, Azure and GCP. We are agent agnostic and support agents built through any agent development framework including Langchain, CrewAI etc.

Alterion's policy engine lets you define rules once and enforce them everywhere. Import your existing compliance policies in plain language or CSV format—Alterion's Small Language Models translates them into actionable rules and applies them to the right agents and boundaries across every cloud, automatically.

Yes. Discovery runs continuously rather than just at deployment. New agents appear in the inventory the first time they act, and a default guardrails applies to unregistered agents until someone takes ownership.

In a customer-hosted deployment, Alterion the company sees nothing. The control plane inspects agent traffic inside your environment: prompts, tool calls, responses, and the spans between them. Every artifact it produces stays in storage you own.

Optional product telemetry is off by default, is limited to aggregate health metrics with no payload content, and can be disabled permanently at install time.

We believe that detecting every agent in the enterprise, especially unsanctioned or shadow agents, requires detection at the runtime (malicious actors will not use your SDK!). Additionally, we believe engineering and business teams should focus on launching agents and driving business value quickly, not being slowed down by SDK integrations and dev time assessments. Enabling governance at the runtime enables your business to move fast and stay competitive, while providing governance at the only time that matters - when the agent is running autonomously with production data and systems.

Yes, Alterion runs entirely in your environment, on-prem and air-gapped. You control what leaves your walls, and what reaches external models.

No. Audit packs come from the runtime, eliminating the need for a separate team to conduct audits.

None, and no SDKs. It runs entirely in your stack.

None.

No. Alterion runs entirely in your stack.

Policy is enforced in the path, per action, so you can block a single tool call or data transfer and let the rest run. Every prompt, tool call and response gets a verdict in under 100 milliseconds, so your eng team isn't slowed down.

Real-time token and agent spend by team, agent and use case, on the same pane as governance.

A live, explainable risk score per agent from behavior, identity, permissions and blast radius, so the alert stream becomes a ranked list.

Behavior that diverges from intent across a session, the failure mode you cannot write a rule for in advance.

No. Alterion interoperates as the central plane, pulling your gateways, SWG, EDR and DLP into one policy and one view, and filling the gaps between them.

Yes. Author policy once in Draco and enforce through Aquila, Zscaler, your EDR or your DLP. It is not a rip-and-replace.

Sensors across endpoints, SaaS and cloud observe activity at the runtime, so shadow and third-party agents surface next to the ones you instrumented. Discovery does not depend on an agent being declared.

Yes. Air-gapped installs are a first-class deployment model, not an exception path. Detection runs on locally served models, policy packs are imported as signed bundles, and licensing is validated offline. Outbound egress is blocked and verified at deploy time.

Traditional policy tools enforce rules based on access permissions (what an agent can do). Alterion's contextual boundaries enforce rules based on intent (what an agent should be doing). A finance agent can't talk to the customer support database not because of a hardcoded rule, but because the system understands the agent's purpose and baseline behavior, and prevents actions outside their intended scope.

No agent code changes or SDKs.

Alterion is air-gapped and runs in your stack, so residency is answered by the deployment itself.

97.5% classification accuracy, with a verdict in under 100 milliseconds.

In your VPC, models included, with no egress.

None, and no SDKs.

You decide, agent by agent: register it and assign an owner, allow it under a policy, restrict what it can reach, or quarantine it. Every action is taken from one place (Draco), which applies to the agent, wherever it is.

Route each task to the best-value model automatically, and cap or kill runaway agents before spend runs away.

Evidence is generated from runtime activity and mapped to SOC 2, ISO 42001, NIST AI RMF, HIPAA and the EU AI Act. It is produced from the runtime, not assembled for the audit.

Three layers, one record: heuristic, semantic that reads intent, and behavioral that tracks drift over time, judged in-path by purpose-built small language models.

Runtime enforcement covers the seams siloed tools leave, and discovery surfaces the shadow agents none of them can see.

Aquila checks browser AI and personal ChatGPT on the device, above encryption, before data leaves the browser, with no TLS termination.

No. Discovery and enforcement both work from the runtime, with no agent code changes and no SDKs.

Your deployment does, and nothing else. Our intelligence layer is built as a network of specialized small language models that reason together and draw on persistent enterprise memory, so the system learns your environment over time. That is the product working as designed. A control plane that cannot learn your baseline cannot tell normal from anomalous.

Sovereignty is part of that architecture, not a setting layered on top. The models, the memory, and the enterprise context all stay inside the security boundary they exist to protect. Nothing is returned to Alterion, pooled across customers, or used to improve what we ship.

Binding in our Enterprise Terms: no customer input, output, or captured span is ever used to train, fine-tune, or evaluate any third-party model or any model Alterion distributes out of the box.

Yes. Alterion monitors prompts flowing through your agents in real time and flags injection patterns—including attempts to override system instructions or escalate permissions through text, files or images. When detected, we trigger remediation automatically.

Yes. Spend is attributable by team, agent and use case, so cost becomes a governed, provable line rather than an estimate.

Scoring is part of the full solution. As an agent's live risk score climbs, runtime governance tightens boundaries and blocks off-policy actions.

Yes. The MCP and function-calling step is judged across every prompt, response, tool call and payload.

Yes. Set policy once and apply it across every agent and environment.

Every prompt, tool call and commit is checked pre-execution on the device, so secrets and non-compliant code are stopped before they run.

Each agent is traced through the credentials, accounts and systems it uses back to a person or team. Anything that can’t be attributed is flagged as unowned. No agent sits in the inventory without a human accountable for it.

Yes. Spend is attributable by team, agent and use case, so cost becomes a governed, provable line rather than an estimate.

Runtime governance acts on it, tightening boundaries and blocking off-policy actions as risk climbs.

Yes. The MCP and function-calling step nothing else controls is judged across prompt, response, tool call and payload.

Yes. Set policy once and apply it across every agent and environment.

Every prompt, tool call and commit is checked pre-execution on the device, so secrets and non-compliant code are stopped before they run.

Those map cloud posture and known assets. Alterion discovers agents by what they do at runtime, attributes each to an owner, and enforces in the path, including the shadow agents those tools do not see.

Access is role-based and scoped to a Boundary, so a team only sees the agents and sessions inside its own scope. Authentication is via your IdP over SAML with SCIM provisioning. Every privileged action writes to an append-only audit log you can stream to your SIEM.

Identity tools know who an agent is. Alterion knows what it's doing. Agents aren't users; they don't have job titles, org charts, or intent you can read from a permission set. Alterion was built from first principles for non-deterministic, autonomous systems. That's a fundamentally different architecture than retrofitting an IAM tool.

The design rests on one idea: test every cost change before it reaches live traffic, then apply it at the gateway so the agent's code never changes.

Evidence is audit-ready, generated from runtime activity and mapped to SOC 2, ISO 42001, NIST AI RMF, HIPAA and the EU AI Act. It is produced live from the runtime.

Three types of controls: heuristic (matches known patterns) semantic (reads intent), and behavioral (tracks drift over time), judged in-path by purpose-built small language models.

Runtime enforcement covers the seams siloed tools leave, and discovery surfaces the shadow agents none of them can see.

Aquila checks browser AI and personal ChatGPT on the device, above encryption, before data leaves the browser, with no TLS termination.

Sensors across endpoints, SaaS and cloud observe activity at runtime, and agent traffic routes through a proxy deployed in your environment, so shadow and third-party agents surface next to the ones you instrumented.

No agent code changes or SDKs.

Alterion is air-gapped and runs in your stack, so residency is answered by the deployment itself.

97.5% classification accuracy across six small language models, with a verdict in under 100 milliseconds.

In your VPC, models included, with no egress.

None, and no SDKs.

Nowhere. Alterion runs entirely in your environment, in your VPC or on-prem, models included. Nothing leaves your walls.

TLS 1.2+ in transit and AES-256 at rest, with envelope encryption keyed by your own KMS. Retention is customer-configured per Boundary, defaults to 90 days, and supports immediate hard deletion on request.

We believe agents are a new class of technology that require a different paradigm to managing, securing and governing, that does not fit in the existing enterprise IT stack. This is why we built Alterion, the intelligent runtime control plane for agents, providing comprehensive observability, security, governance and optimization for enterprises.

Traffic runs through the Alterion gateway, where every request logs the route and model. Alterion prices those tokens at each model's current rate, tracked live as prices change. Each request is tied to its Session and Trace, so you can break spend down by person, agent, Boundary (team) and Session.

Alterion scores every agent from its past and live behavior, identity, permissions and blast radius, using a set of fine-tuned expert models. Your alert stream becomes a ranked list.

Agent drift is when an AI agent gradually starts doing something different from what it was set up to do, even if nobody changed it on purpose.

No. Alterion interoperates as the central plane, pulling your gateways, SWG, EDR and DLP into one policy and one view, and filling the gaps between them.

Yes. Author policy once in Draco and enforce through Aquila, Zscaler, your EDR or your DLP. It is not a rip-and-replace.

Any AI agent acting in your environment that security didn’t approve; nor could see. I.e. A coding agent on a laptop, a serverless agent deployed in the cloud, or a third-party agent calling your systems with a shared credential.

Yes, entirely in your stack, with cost on the same pane as governance.

No. Audit packs come from the runtime, without building an army of a team.

None, and no SDKs. It runs entirely in your stack.

None.

No. Alterion runs entirely in your stack.

A single read-only scan in your VPC produces the inventory. Deployment is days, not months.

No. There are no SDKs to embed, no code changes, and no agent rewrites. Alterion sits between your agents and your infrastructure at the network layer, which is also why it catches shadow AI that nobody registered with you.