Ghalta
Get in touch
Menu

Products

How it works

Trust

Agents act. You set the limits.

Ghalta is the agentic security control plane between agents and their tools.

Meet the gateway Inspect a decision

Every autonomous action needs identity, policy, approval, and evidence.

  1. Allow ran, recorded

  2. Deny stopped before the tool

  3. Held waits for a person

The tool boundary Three illustrative calls from a demo workspace meet one rule set. Nothing here calls a backend. Select a call to replay it. Ghalta is pre-beta.

Decision receipt illustrative

demo workspaceseq 00041814:03:08Z

decision
dec_demo_9f31
agent
acme-agent-07
tool
db.deleteProductionRecords
rule
prod-write-deny
outcome
deny
signature
Ed25519 · demo, not valid

Verify offline with ghalta-verify

Agents act. Credentials outlive them.

A conversation can end while its access remains. The risks sit in credentials, permissions, and the record of what happened.

Read the external sources and their limits in the research notes.

  • Keys that never expire

    Agents need credentials to reach tools. A key that never expires stays useful to anyone who takes it.

  • No trail to check

    Who reached what, last week? What was stopped, and why? Without a tamper-evident record, nobody can answer.

  • Filters read words, agents take actions

    Once an injected instruction passes a text filter, the damage depends on what the agent is allowed to do.

Inspect a decision

Three illustrative calls, three verdicts. Pick one to see the request, the rule, and the receipt.

Illustrative demo data — Acme Bank demo workspace. No backend call; example receipts are not valid signatures.

Choose a tool call to inspect

Denied. The call was stopped before it reached any tool.

Allowed. The read ran and was recorded.

Request
Agent acme-agent-07 (scope inbox:read) calls inbox.summarise.
Matching rule
inbox-read-own → allow. Read-only call inside the agent's scope.
Evidence
Decision dec_demo_41ac appended to the audit trail and receipted.
Illustrative decision summary
decision:  dec_demo_41ac
agent:     acme-agent-07
tool:      inbox.summarise
outcome:   allow
signature: Ed25519 ILLUSTRATIVE — not a valid signature

Denied. The call was stopped before it reached any tool.

Request
Agent acme-agent-07 (scope inbox:read) calls db.deleteProductionRecords.
Matching rule
prod-write-deny → deny. Production writes are outside this agent's scope; this example's deny is the deciding rule.
Evidence
Decision dec_demo_9f31 appended to the audit trail and receipted. A denial does not require approval; people can still review its audit record.
Illustrative decision summary
decision:  dec_demo_9f31
agent:     acme-agent-07
tool:      db.deleteProductionRecords
outcome:   deny (deciding rule)
signature: Ed25519 ILLUSTRATIVE — not a valid signature

Held. The refund waits for a person instead of running.

Request
Agent acme-agent-07 (scope billing:refund) calls payments.issueRefund.
Matching rule
refund-over-threshold → require_approval. High-value refunds need a workspace admin.
Evidence
Decision dec_demo_77c2 held and receipted; the pending decision is recorded immediately; the later human decision is recorded separately.
Illustrative decision summary
decision:  dec_demo_77c2
agent:     acme-agent-07
tool:      payments.issueRefund
outcome:   require_approval (waiting for a person)
signature: Ed25519 ILLUSTRATIVE — not a valid signature

Real receipts can be checked offline with ghalta-verify. These summaries are not the receipt wire format and are not cryptographically valid.

Policy comes before execution.

allow
Permit the call.
deny
Stop the call.
redact
Remove matched sensitive content.
require approval
Hold for a person's decision.
log only
Record without blocking.
escalate
Route for further review.

Who is calling, which tool, and what action? The gateway checks the request against policy before execution. Policy priority and rule order apply; deny wins among matches at the deciding priority.

Use dry-run and replay to review decisions before switching to enforcement.

Decisions carry signed evidence

A receipt binds the agent, tenant, tool-call ID, and verdict to a signing key. A proof bundle can also bind it to an audit event and signed checkpoint.

The receipt records the decision, not proof that an outside tool finished the job.

How evidence and audit work

Decision receipt what it binds

Identity
which agent made the call
Tool-call ID
which evaluated call it names
Audit-event ID
receipt-to-audit binding in the current strict path
Decision
the verdict and signing-key identity

Verify offline with ghalta-verify

Start with the tool call.

Reading an inbox and deleting a database are both tool calls. They need different permissions. AASG is where those rules are checked.

AASG

Agentic AI Security Gateway

The control point between an agent and a tool. It checks the caller's identity and the requested action against policy, then records the decision.

In practice An agent may read an inbox, be blocked from deleting records, or wait for approval before a refund.

Built — development scope.

Explore the gateway

Ghalta Studio

Build and use agents under policy

Implemented chat, agent definitions, and governed worker execution, with a text tokenization boundary and configured model providers.

Built — development scope.

Explore Studio

Discovery Agent

Find AI access that needs review

Implemented network observations, connected-app inventory, coverage gaps, and tool discovery. Visibility depends on configured evidence sources.

Built — development scope.

Explore Discovery

The gateway governs calls routed through it. See the architecture and boundaries, or check what is built and what is planned.

What you can evaluate today.

Gateway, Studio, and Discovery have implemented code paths. Deployment availability and integration coverage must be checked separately.

Read the full roadmap

Built
Gateway policy, approvals, evidence, Studio, and Discovery.
Bounded
Single-turn worker steps; configured routes and detectors.
Next
Deployment validation and remaining execution limits; no release dates inferred.
What the research says 6 verified sources

Quoted exactly. Scopes matter: the EU figure covers enterprises using any AI technology, not agents; the NIST audit item is a question to the public, not a finding; the hijacking test covers one agent in one setup.

  • 19.95%

    About one in five EU enterprises with 10 or more employees used at least one AI technology in 2025.

    Read source excerpt
    In 2025, 19.95% of EU enterprises used AI technologies.

    Source: Eurostat, retrieved

  • extremely common

    OWASP's list of non-human identity risks rates long-lived secrets, such as keys and tokens that never expire, as widespread.

    Read source excerpt
    Long-Lived Secrets are extremely common in modern environments.

    Source: OWASP Non-Human Identities Top 10, retrieved

  • 94 days

    Verizon's 2025 breach report puts the median time to fix a secret leaked on GitHub at 94 days.

    Read source excerpt
    Figure 13 gives us an idea of the exposure window, where the median time to remediate discovered leaked secrets on a GitHub repository is 94 days, courtesy of one of our data contributors.

    Source: Verizon, Data Breach Investigations Report, retrieved

  • tamper-proof and verifiable

    In a draft paper, NIST asks the public how AI agents can keep tamper-proof, verifiable logs of their actions.

    Read source excerpt
    How can we ensure that agents log their actions and intent in a tamper-proof and verifiable manner?

    Source: NIST National Cybersecurity Center of Excellence, retrieved

  • unclear if there are fool-proof methods of prevention

    OWASP says it is unclear whether any method fully prevents prompt injection; the measures it lists mitigate the impact.

    Read source excerpt
    Given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention for prompt injection.

    Source: OWASP GenAI Security Project, retrieved

  • from 11% for the strongest baseline attack to 81% for the strongest new attack

    In a NIST test of one AI agent, attacks built for that agent hijacked it far more often than the best known attack.

    Read source excerpt
    This resulted in an increase in attack success rate from 11% for the strongest baseline attack to 81% for the strongest new attack.

    Source: NIST Center for AI Standards and Innovation (CAISI), retrieved

Which action needs a boundary?

Tell us what your agent connects to and which actions need a rule or a human decision.

mic.nordin.06@gmail.com

A useful starting point. One workflow, the tools it calls, and the access it has today. That is enough to start a technical conversation.

Contact details