Agents inside the boundary, with the paperwork done
Agencies and their contractors want coding agents on legacy systems and citizen services. Prismor gives the authorising official one signed policy, an air-gap-friendly deployment, and a trail that maps to the control catalogue.
Where agent rollouts stall in the public sector
The authorisation package needs to say what the system does. An autonomous agent does whatever its prompt leads to, unless something constrains it.
Uncontrolled data egress
An agent on a workstation can send code and documents to any model provider or endpoint. Boundary controls do not see inside the tool call.
No system-level accountability
Audit and incident response need who ran what, on which system, under which authorisation, at the level of the action rather than the chat.
Contractor and vendor agents
Third parties bring their own agents and MCP servers into the environment with no shared policy or inventory.
Controls that map to the catalogue
Access control, audit and configuration management for agents, enforced at runtime.
Signed policy with hardened rules
Central rules that agents and developers cannot disable, versioned and attributable to an administrator.
On-prem or air-gapped control plane
Run the console inside your enclave. Policy evaluation already happens locally, so nothing depends on an external service.
Tamper-evident audit trail
Hash-chained record of every tool call and decision, exportable to your SIEM over OCSF or as a Proof Pack.
Identity-bound devices and agents
Every enrolled device and agent holds its own credential. Revoke one without touching the rest.
What we see in the field
Three observations from teams in this sector, before the product pitch.
The authorisation package needs a bounded system
An ATO describes what a system does and what it can reach. An unconstrained agent is a system whose behaviour is defined at runtime by a prompt. Signed policy is what turns it back into something an assessor can describe.
Boundary controls do not see the tool call
Network egress rules see a connection to a model provider. They do not see that the payload is a source file, or that an MCP server returned an instruction the agent then followed. The control has to sit where the action is decided.
Contractors bring the agents
System integrators arrive with their own agents, keys and MCP servers. Without a shared policy pushed to their devices, the agency inherits whatever each vendor configured.
How Prismor fits
Prismor runs inside the boundary you already authorise and reports into the tooling your security operations already run.
Inside the enclave
Open-source runtime on each device evaluates policy locally. The control plane self-hosts in your VPC or on-prem; no external dependency to enforce.
Under your identity and device model
Devices and agents enrol with their own credentials under your SSO and SCIM. Contractor devices receive the same signed policy as staff.
Into your SOC and assessment
Agent activity streams over OCSF to the SIEM. Proof Pack exports supply the audit and accountability evidence for the control assessment.
What platform and security teams get
Tool-call interception
Shell, file, network and MCP calls checked against policy before they execute.
Egress allowlist
Only named hosts are reachable. Model providers, package registries and internal services are enumerated, everything else denied.
Secret cloaking
Credentials swapped for placeholders before the agent sees them, restored only at execution.
MCP gateway
A single governed endpoint in front of internal MCP servers, with per-tool policy and result screening.
Shadow AI discovery
Inventory agents, MCP servers and keys on every enrolled machine, including unmanaged ones.
Approvals
Route privileged actions to a named approver and keep the decision in the record.
Agent workflows in agencies, governed by Prismor
- Legacy modernisation
Coding agents on mainframe and Java estates inside a policy that names every reachable host.
- Citizen-service development
Assistants building and testing public-facing apps without production credentials.
- Contractor onboarding
Push one policy to every vendor device before their agents touch the environment.
- Security operations
Agent activity in the SIEM alongside endpoint and network detections.
- Authorisation evidence
Per-agent permitted and actual behaviour for the control assessment.
- Pilot programmes
Observe-only mode to measure what agents attempt before enforcing.
Deployment that fits the boundary
Policy is evaluated where the agent runs. Where the console lives is up to you.
Open-source runtime
The interception layer runs on the developer machine or the agent host. Policy is evaluated locally, so a blocked tool call never leaves the box.
Hosted control plane
Enrol devices and agents to the Prismor console for fleet-wide policy, live activity, approvals and Proof Pack exports.
Self-hosted or on-prem
Run the control plane inside your own VPC or data centre on Enterprise plans, with telemetry routed to your SIEM over OCSF.
Fail closed
If a signed policy cannot be verified or the runtime is tampered with, the agent stops rather than running unchecked.
Frequently asked questions
Can Prismor run with no connection to the internet?
The runtime evaluates policy locally and does not need a network connection to enforce. The control plane can be self-hosted inside your boundary on Enterprise plans.
How does this map to NIST controls?
Signed policy and hardened rules support access-enforcement and configuration-management controls. The hash-chained trail and OCSF export support audit and accountability. The Compliance Hub walks through the mapping.
Can we govern agents brought in by contractors?
Yes. Devices enrol under your organisation and receive your signed policy. Shadow AI discovery finds agents and MCP servers that were installed outside enrolment.
Is the runtime open source?
Yes. The interception runtime and CLI are open source and can be reviewed line by line before deployment.
Want a control plane over your AI agents?
Prismor checks every tool call your agents make against your policy, blocks what breaks it, and keeps the audit trail. Run the open-source runtime yourself, or let us set it up across your org.
Or email [email protected]