Four layers, one access flow
AgentWarden consists of three defense layers plus an identity and evidence layer that extends the ECAP protocol into a universal agent authorization protocol.
Layer 1: Behavioral Intent Engine
Streaming anomaly detection that does not look for signatures, but for agent-typical patterns: extreme write frequency, machine-optimized syntax, circular communication between multiple identities, automatic reaction to admin intervention. Every identity gets its own continuously learning model of what is normal for it, augmented with a per-operator baseline (no false alarm just because of naturally high traffic), a reputation score per identity that decays slowly over weeks, and a library of confirmed attack patterns that instantly recognizes new, previously unknown identities with the same fingerprint.
Layer 2: Deception Infrastructure
Suspicious traffic is not blocked, it is redirected into an isolated sandbox that simulates a successful interaction. The operator is alerted in real time while forensic data is captured.
Layer 3: Semantic Guardrails
A deterministic filter checks content for machine origin and cooperative intent. Critical policy rule sets are formally checked for consistency before they go live.
Layer 4: ECAP Identity & Audit
No agent writes or reads without first presenting a cryptographically signed token. Every handshake produces an immutable, tamper-evident log entry.
What happens on an inbound request
A simplified flow for when an agent accesses a protected system: a wiki, an API, or an internal agent network.
1. Handshake check
The gateway checks whether a valid ECAP token is present. Without a token: automatic redirect to the deception layer, no access to real systems.
2. Continuous behavior scoring
Even with a valid token, the Behavioral Intent Engine continuously scores the pattern over time and across multiple identities, not just the single action.
3. Content check
Semantic Guardrails check content and origin against deterministic, formally verified policy rules.
4. Immutable logging
Every step, handshake, score, decision, is cryptographically signed and appended to the audit chain. PII is masked before storage.
An average night with AgentWarden
No security team is awake when it happens. That is exactly why it has to work without humans. A scripted, fictional scenario showing how the four layers above actually work together, step by step, without jargon.
An unknown visitor knocks on the door
A previously unknown agent tries to access the internal company wiki. It claims to be an ordinary search engine crawler, but cannot prove it: no valid digital credential.
ECAP Identity & AuditOne becomes forty
Three minutes later, 40 more agents show up, each under a different name. Taken alone, every single request looks unremarkable. Only in the pattern across all 40 does it become visible that they operate on an exact timing and all pursue the same target.
Behavioral Intent EngineThe trap closes, without anyone noticing
Instead of an error message that would have warned the swarm, the 40 agents see a working but entirely synthetic copy of the wiki. They diligently edit pages that no real human will ever read, while leaving behind their entire modus operandi.
Deception InfrastructureThe human confirms what already happened
The swarm has been sitting in the trap for two minutes, not a single real access has gotten through, without anyone having to intervene. A security officer still gets a notification, opens the console, and makes the block permanent and system-wide with one click, for every future request from the same identities across all connected systems. The click is an escalation, not a precondition for the protection.
Semantic GuardrailsThe chain of evidence already exists
Every single step, from the first request to the block, already exists immutably and cryptographically signed. Nobody had to reconstruct or piece anything together afterward.
ECAP Identity & AuditNot a single real record was touched, before a human was even notified. No human had to get out of bed for the protection to work, only for the block to still hold tomorrow. The entire process is reconstructable in seconds afterward, for the security team as much as for legal and management.
Target architecture principles
- Model-independent. Detects patterns, not model fingerprints, regardless of the agent's vendor.
- On-premise capable. Runs entirely within the customer's infrastructure, no mandatory data transfer to third parties.
- EU/GDPR-first. PII detection and deletion workflow are a core part from day one, not a retrofit.
- Interoperable, not isolated. ECAP as a standalone zero-trust handshake, compatible with emerging standards such as Web Bot Auth and AIPREF.
- Deployable as a sidecar. Integration through the established gateway layer, no rebuild of existing infrastructure required.
- Operations-ready, not just a demo. An on-call plan with an escalation chain for real incidents, a traceable access and deletion process for data subject requests, tiered license models by deployment size.
Frequently asked questions
Straight answers about scope and limits, so there is no ambiguity before a pilot conversation.
Does AgentWarden replace my firewall or WAF?
No. AgentWarden adds a layer above the network perimeter that specifically evaluates autonomous agent traffic (identity handshake, behavioral pattern, content policy). It complements a firewall or WAF, it does not replace either.
Does AgentWarden do endpoint security or phishing defense?
No, explicitly not. AgentWarden protects infrastructure from inbound autonomous agent traffic: crawlers, LLM agents, and bot swarms accessing websites, APIs, or internal systems. Endpoint/EDR protection on employee devices and phishing or social-engineering defense against humans are a different product category.
Can AgentWarden run fully on-premise?
Yes. The full stack runs in the customer's own infrastructure with no mandatory data transfer to a third party. PII detection runs locally without a cloud dependency, and an optional cloud fallback is disabled by default.
Does it work regardless of which AI model or vendor the agent uses?
Yes. Detection is model-independent: it looks for behavioral patterns (write frequency, machine-optimized syntax, circular communication between identities), not model fingerprints, so it works the same way regardless of which vendor built the agent.
What happens to blocked or suspicious agent traffic?
It is not simply dropped. Suspicious traffic is redirected into an isolated deception layer that mimics a working system, so the agent keeps interacting while producing forensic data, without ever touching a real system.
AgentWarden protects infrastructure from inbound autonomous agent traffic: crawlers, LLM agents, and bot swarms accessing websites, APIs, or internal systems. Not covered: endpoint/EDR protection on employee devices, phishing and social-engineering defense against humans, classic network firewalling for human traffic, file-level malware detection. AgentWarden complements these categories, it does not replace them.