Set the rules for your agents and verify their intent.
Classie checks prompts, responses and tool calls against your policies while an agent acts, then runs the same rules over the recorded sessions for investigation and audit.
AI actions are spread across tools that don’t share a record.
AI usage and governance gained more ground than most initiatives in CISOs’ top five for 2027.
a16z CISO Survey, 2026of CISOs are comfortable with AI agents in security operations only when a human approves.
a16z CISO Survey, 2026of security leaders doubt they could pass an audit focused on agent behavior or access.
Cloud Security Alliance and Strata Identity, 2026of organizations with an AI-related breach lacked proper AI access controls.
IBM Cost of a Data Breach, 2025Every control mapped to the frameworks you report against.
Each policy maps to the frameworks your team reports against, with the transcripts behind it as evidence. OWASP is shown here. An audit package for any agent and period is one request away.
| ID | OWASP risk | Classie control | Status |
|---|
| ASI01 | Agent goal hijack | Intent classification, inline block | Covered |
| MCP09 | Shadow MCP servers | MCP discovery, approved-server list | Partial |
| ASI03 | Identity and privilege abuse | Identity chain, personal-account block | Covered |
| MCP01 | Token mismanagement and secret exposure | Credential detection and redaction | Covered |
| ASI02 | Tool misuse and exploitation | Human approval on tool calls | Covered |
| MCP08 | Lack of audit and telemetry | Transcript of every session | Covered |
| ASI08 | Cascading failures | Runtime alerts | Partial |
| MCP07 | Insufficient authentication and authorization | Per-user identity on MCP calls | Covered |
| ASI06 | Memory and context poisoning | Context inspection | Partial |
| MCP03 | Tool poisoning | Tool description scanning | Covered |
| ASI01 | Agent goal hijack | Intent classification, inline block | Covered |
| MCP09 | Shadow MCP servers | MCP discovery, approved-server list | Partial |
| ASI03 | Identity and privilege abuse | Identity chain, personal-account block | Covered |
| MCP01 | Token mismanagement and secret exposure | Credential detection and redaction | Covered |
| ASI02 | Tool misuse and exploitation | Human approval on tool calls | Covered |
Every agent session, tied to a known user.
One transcript joins what every sensor saw: who acted, through which agent, with what data, and which tools were called. Anonymous sessions are bound to the person behind them.
Rules for who can use what,
and how.
Start from a starter pack, then add exceptions, allowlists and denylists. Rules can use a person’s group, role and how they connect, so a Jira plugin and a Jira MCP connection can get different answers.
The same rules, while an agent acts and afterwards.
Inline, a hook checks a tool call before it runs and the content it returns, and blocks, redacts or warns without a round trip to a backend. Afterwards, the same rules run over recorded sessions, so you can investigate what happened, through which agent and for whom.
| Event | Check | Decision |
|---|---|---|
| Shell command with an API key | Before the tool runs | Redacted |
| Call to an unapproved MCP server | Before the tool runs | Blocked |
| Response containing client PII | After the tool returns | Redacted |
| Commit to an approved repository | Before the tool runs | Allowed |
15 minute installation. No blind spots.
See the full record of what the agents in your environment did, and the audit package it builds.
Runs in your environment. Your data never leaves the perimeter you govern.