Menu
Blog How it works Use Cases
agentsh
Open-source runtime for AI agent security
Beacon
AI endpoint visibility and control
Watchtower
Enterprise control plane for agentsh and Beacon
Request Access
Category

Execution-Layer Security.

AI security has been treated as a prompt problem. But the real risk is execution: files, network, processes, and secrets. Execution-Layer Security enforces least privilege at runtime, across supervised copilots and unsupervised agents.

The shift

AI is moving from "assist" to "execute".

The enemy

The prompt is not the perimeter.

Prompt-time defenses are important, but they are probabilistic. Even a well-aligned model can be tricked, misled, or simply take the wrong step. When AI can execute — access files, open network connections, run commands, read secrets — security needs deterministic controls where actions happen, not just where instructions are parsed.

Models are probabilistic. Execution must be deterministic.

Prompt injection

Malicious instructions embedded in data can hijack agent behavior. Controls at the execution layer limit what a compromised agent can actually do.

Tool misuse

Agents call the right tool with the wrong arguments — or the wrong tool entirely. Runtime policy catches actions that don't match intent.

Misconfiguration

Overly permissive settings, stale credentials, and forgotten access paths. Execution-layer enforcement applies least privilege regardless of configuration drift.

Definition

What Execution-Layer Security means.

Execution-Layer Security is the runtime enforcement and audit layer that governs what AI workloads can do: files, network, processes, and secrets — independent of prompt compliance.

Evaluate at execution time

Policies evaluate actions at the moment they happen — not after the damage is done. Every file access, network call, and command is checked before it executes.

Explicit decisions

Every action gets a clear verdict: allow, prompt (human-in-the-loop), block, or redirect to an approved alternative. No ambiguity, no silent failures.

Full context preserved

Decisions include the tool that triggered the action, the full process chain, destination, command, and scope — so security teams can reconstruct exactly what happened.

Auditable and exportable

Every decision is logged with full context and exportable to your SIEM (Splunk, Sentinel, QRadar) or OpenTelemetry pipeline for compliance and forensics.

Model and harness agnostic

Works the same regardless of which model, framework, or AI tool triggered the action. Claude, GPT, Gemini, LangChain, CrewAI, custom agents — enforcement happens at the OS and network layer, not the model layer.

Steer, not just block

Redirect actions to approved alternatives instead of hard-blocking. Dependency installs go to internal mirrors, API calls route through approved gateways — agents stay productive.

Two contexts

Two execution contexts. Same control.

Supervised

Supervised AI on endpoints

Beacon

Copilots and desktop AI tools operate with user permissions. "Human in the loop" does not guarantee safety unless the system can enforce policy at runtime — controlling what tools can access, connect to, and execute.

Learn about Beacon
Unsupervised

Unsupervised agents in CI, containers, and dev environments

AgentSH

Headless agents execute without UI prompts. They need deny-by-default capabilities and explicit allowances — for network, filesystem, commands, and secrets.

Learn about AgentSH
Execution-Layer Security treats both as the same underlying problem: runtime capabilities.
Our system

How Canyon Road implements Execution-Layer Security.

Beacon

Monitors and controls supervised AI on employee endpoints — macOS and Windows. Per-app visibility, runtime policy, and human-in-the-loop approvals for desktop AI tools like Claude, Cursor, and ChatGPT.

Learn about Beacon →

AgentSH

Wraps unsupervised AI agents in CI, containers, and dev environments. Enforces least-privilege policy at execution time — network, filesystem, commands, and secrets. Open source.

Learn about AgentSH →

Watchtower

The command center: central policy management, approval routing, SIEM export, fleet-wide kill switch, and RBAC. Governs both Beacon and AgentSH from one place.

Learn about Watchtower →
One policy language. Local enforcement. Central governance.
Complements

How this fits with what you already use.

Prompt and model defenses

We complement red-teaming, evals, and safe prompting by bounding blast radius when they fail.

EDR / DLP

EDR and DLP are critical, but they were built for humans and apps, not machine-speed agent execution. Execution-Layer Security adds AI-aware context and enforcement at the moment of action.

Sandboxes and isolation

Isolation is necessary but not sufficient. Execution-Layer Security is about policy-driven capabilities, not just "inside vs outside".

Philosophy

Steer, don't just block.

Hard blocks often cause agents to retry, escalate, or route around restrictions. Steering keeps teams productive: redirect dependency downloads to approved registries, route model calls to approved gateways, and constrain endpoints without breaking workflows.

Redirect registries

Instead of blocking npm install or pip install, redirect dependency downloads to your internal mirrors and approved registries. Agents keep working; supply chain stays clean.

Route API calls

Redirect outbound API calls to approved domains and gateways. Model calls go through your proxy, data stays in approved channels, and shadow endpoints get caught.

Prompt for risk

For high-risk commands like deploy, credential access, or database mutations — prompt a human for approval instead of blocking. Keeps automation flowing with a safety net.

FAQ

FAQ

Is this only about prompt injection?

No. Prompt injection is one cause of unsafe execution. Execution-Layer Security reduces risk from any failure mode: injection, mistakes, tool misuse, misconfiguration, or compromised dependencies.

What's the difference between Beacon and AgentSH?

Beacon secures supervised AI workloads on endpoints. AgentSH secures unsupervised agentic workloads in CI, containers, and dev environments.

Where does Watchtower fit?

Watchtower is the command center: central policies, approvals routing, SIEM export, and a fleet-wide kill switch. Beacon and AgentSH enforce locally at execution time.

Secure what AI can do, not just what it says.

Explore use cases Request early access →