Secure AI agents, tools, and decisions with Intertrace
The runtime layer for enterprise AI security
When an agent acts, three things happen at once: a prompt, a tool, a decision. Intertrace inspects all three while the call is still open, holds what should not run, and keeps a record a person can take to review. That is the difference between hoping the model behaves and operating a runtime you can defend.
+Meet HIRO
Watches every call. Stops the wrong ones.
This is HIRO. Drag it around, spin the space around it, or tap it to change its mood. Leave it alone and it acts out what Intertrace does with sample agent calls: checks each one, lets the safe ones through and stops the rest.
Monitors agent activity, tool calls, and data access in real time.
Drag it · Spin around it · Tap it
Meet HIRO in 90 seconds.
Eight agent calls, one decision each, and the trace that records why. Sample calls, not live traffic.
+Launch film
One request. Every check.
Follow one refund request through Intertrace — found, redacted, attacked, approved and run — then see everything else: discovery, roles, policy as code, MCP threat intel, limits, traces and containment.
Your agents have permissions.
But do they have authority?
That gap becomes dangerous as agents gain more autonomy.
An agent with access to your systems does not need malicious intent to cause damage. A misunderstood instruction, compromised tool, prompt injection, excessive permission, unexpected reasoning path, or incorrect decision can be enough.
And once the action has happened, traditional logs often leave security teams reconstructing the story across dozens of disconnected systems.
Intertrace is built to stop that.
Intertrace places deterministic policy, compact intent routing, and managed AI safety checks between your applications and LLM providers. Runtime verification and Guardian detection run on the Intertrace-hosted edge. Pre-action authorization (POST /v1/actions/authorize) returns stage-level latency telemetry in a Server-Timing header you can read from your own environment; chat completions do not carry it yet.
+The platform
Three layers. One integration.
The privileged moment is the API call. Intertrace sits where the traffic already flows and reasons at the same layer as the model.
AI Security Gateway
Real-time classification
Every API call is checked for prompt injection, jailbreaks and personal data. Cheap deterministic checks run first, and the AI judge runs when they cannot clear the call. Tool-call policy and versioned policy packs feed the same control plane your security team uses.
- Neural injection & jailbreak detection
- PII detection & redaction
- Tool-call policy + policy packs
Runtime Verification
Agent behavior monitoring
Runtime watches behavior end-to-end: intent alignment and tool usage, with chain-of-thought captured for review when the provider returns it. Correlate traffic with run IDs, inspect spans and gateway hops, and fail closed when verification demands it.
- Chain-of-thought captured for review
- Intent-alignment scoring
- Autonomous guardrail enforcement
Guardian detection & response
Review · recommend · approve
Guardian's rules review AI traffic and estate risk and queue prioritized actions in Work. HIRO, the AI security analyst, answers questions and investigates with cited evidence. People approve every remediation.
- Scheduled and event-driven risk reviews
- HIRO, the AI security analyst, with cited evidence
- Approval-gated remediation
+Gateway
Decisions at gateway latency — not post hoc.
Every prompt and response is classified inline, with a structured event on every hop. Prompts and buffered responses can be blocked, redacted, or allowed; streamed responses can be blocked but not redacted.
+Runtime
Your AI passed every test. Then it went rogue in production.
Runtime verification proves what the agent is doing now — not what it once scored on a benchmark.
+Guardian
Rules find it. HIRO explains it. People approve.
Guardian's rules review traffic and estate risk and queue prioritized actions in Work. HIRO, the AI security analyst, investigates with cited evidence. Remediations wait for a person to approve them.
+Live demo
Try it. Right now.
Type any prompt and see how it's classified. This is a simulation on our web server, not the production gateway: it runs deterministic checks, plus an AI classifier when one is configured. The production gateway adds guard models, its AI judge and decision fusion.
Type a prompt or pick a scenario. This runs the Simulation Lab's Intertrace Unified Detection Engine (IUDE) on our web server: deterministic checks, plus an AI classifier when one is configured. It does not call the production gateway.
+Works with the stack you already run
Models. Builders. Apps.
Models and agent frameworks you route through Intertrace are in the call path: same runtime, same hold, same record. Each model shows how Intertrace reaches it. AI applications such as ChatGPT, Microsoft Copilot and Gemini are discovered from identity, browser and network sources — visibility, not inline enforcement.
+Models · Hosted keys, your own key, OpenRouter or a customer-hosted gateway
+Agent builders · Frameworks and orchestration
+AI applications · Discovered and inventoried, not proxied
Hosted: works with Intertrace's keys (OpenAI models run through OpenRouter unless you add your own OpenAI key). Your key: add that provider's key in Intertrace. Via OpenRouter: the model family, served through OpenRouter. Customer-hosted: a customer-hosted gateway pointed at your own server.
- OpenAI (Hosted)
- Anthropic (Hosted)
- Mistral (Hosted)
- OpenRouter (Hosted)
- Google Gemini (Your key)
- Azure OpenAI (Your key)
- Groq (Your key)
- Perplexity (Your key)
- Baseten (Your key)
- Llama models (Via OpenRouter)
- DeepSeek models (Via OpenRouter)
- Ollama (Customer-hosted)
- LangChain
- CrewAI
- Vercel AI SDK
- Pydantic AI
- Haystack
- n8n
- OpenAI Agents
- LlamaIndex
- AutoGen
- LiteLLM
- Mastra
- Semantic Kernel
- ChatGPT
- Claude
- Google Gemini
- Microsoft Copilot
- GitHub Copilot
- Cursor
- Windsurf
- Perplexity
- Salesforce Agentforce
- Notion AI
- Le Chat (Mistral)
- Grok
- Glean
- Otter.ai
- Fireflies.ai
- Grammarly
+One minute
How do you know what your agents are doing?
Most teams don't. They hope. Intertrace sits in the request path, so every request, session and decision is traced as it happens.
You don't hope. You trace it.
+Why AI protecting AI
The future is agentic. So are the attacks.
AI runs on trust, but agents and tools expose the weakest links. Without inspection at input, execution, and output, trust is a story you tell after the call. Intertrace is built for the moment the agent still has work to do.
Attacks are language, not CVEs
LLM abuse doesn't ship as a versioned vulnerability — it's new phrasing, new tool chains, new social games every week. The defense has to be in the same class of capability as the model.
Control sits in the request path
The privileged moment is the API call: prompt in, model work, text or tools out. Offline review files incidents after users already saw a bad answer. Decisions belong at gateway latency.
Policy is scope, not a blocklist
Enterprise policy is who the agent is for, what data it may touch, and which tools it may use — not fifty thousand disallowed substrings. Enforcing that takes reading meaning and intent.
+Capabilities
Gateway through evidence.
Classify traffic, enforce tool policy, verify runtime behavior, run Red Team and assessments, and ship evidence your team can stand behind.
+Gateway & policy
Prompt injection defense
Guard models and an AI judge read new phrasings, not just known strings.
PII detection & redaction
Emails, phone numbers, card numbers, SSNs and credentials; redact before forward.
Tool execution policy
Org and per-asset rules; merged policy packs.
+Runtime verification
Intent alignment
Surface drift when behavior leaves declared intent.
Reasoning capture
Chain-of-thought captured for review when the provider returns it.
+Behavioral intelligence
Behavioral baselines
Per-agent profiles; flag meaningful change.
Risk scoring
Posture signals mapped to common frameworks.
+Security testing & evidence
Red Team scenarios
Curated probes, presets, trend vs prior run.
Probe assessments
Queued profiles against your gateway; summaries and artifacts.
Scheduled reviews
Daily attack-surface, blast-radius and least-privilege reviews, plus Guardian's daily sweeps.
Reports & exports
PDF and structured exports for audit.
+Use cases
Built for every team shipping AI.
From regulated enterprises to fast-moving product teams — Intertrace adapts to your market, your agents, and your risk. One runtime control plane, every scenario.
Financial Services
Customer copilots & fraud agents
Constrain AI access to account data and high-impact money-movement workflows.
Financial workflow controls are available in preview with PCI DSS and SOC 2 control mappings.
Healthcare and Life Sciences
Clinical & patient assistants
Protect clinical PHI and constrain patient-facing and clinical agent actions.
Clinical PHI and patient-workflow safeguards are available in preview with HIPAA-aligned control mappings.
Customer Support
Support & success agents
Resist support jailbreaks while preserving verified customer service workflows.
Customer-support action controls and OWASP LLM mappings are available in preview.
Software and Engineering
Coding copilots & dev agents
Protect credentials and source code while constraining autonomous engineering actions.
Engineering-agent controls and OWASP LLM mappings are available in preview.
E-commerce and Retail
Shopping & merchandising agents
Protect customer and payment data while constraining commerce-changing actions.
Commerce action controls are available in preview with PCI DSS and OWASP LLM control mappings.
Government and Public Sector
Citizen-service & analyst agents
Apply strict data handling and independently gate deployment and authorization claims.
Public-sector data handling controls and government framework mappings are available in preview.
Legal and Professional Services
Research & drafting assistants
Isolate matters and preserve structured review evidence for sensitive professional work.
Matter-isolation and disclosure controls with structured decision rationale are available in preview.
Insurance
Claims & underwriting agents
Constrain claims and underwriting actions against declared policy sources.
Insurance claims and underwriting controls with NIST AI RMF mappings are available in preview.
Industry solutions are in preview. Framework references are mappings or aligned-control notes. They are not independent assessments, attestations, certifications, or government authorizations unless separate scoped evidence says so.
Don't see your scenario? Intertrace is model- and framework-agnostic — if your agents touch prompts, tools, or data, we can secure them.
Map your use case+Agent attack graph
Follow the attack path—not a wall of logs.
What it is. The agent attack graph is a map of your AI system: nodes (agents, tools, models, and data) and edges (how control and data moved). The attack path is the highlighted route that shows how abuse propagates from first touch to impact—one coherent chain instead of a pile of disconnected log lines.
What it helps with. Faster triage, clearer blast radius, and a defensible story for security, legal, and leadership—what connected to what, in order, with the framework tags your auditors and SOC expect. The Simulation Lab uses the same graph-on-top, story-below layout with multiple mock scenarios and full readouts.
Poisoned PDF → RAG → support & billing agents → 1.2M PII (Customers DB)
Sample attack path
Poisoned PDF → RAG → agents → sensitive customer data
Bad content entered the RAG context, then steered support and billing agents toward the customer database. The red path is that chain in one view—hops a wall of log lines usually won’t connect.
What it helps with: Helps you brief IR, legal, and leadership on what actually ran, in order—without rebuilding the story from tickets and raw telemetry.
Open the Simulation Lab for four mock scenarios, full risk readouts, and outcome detail.
- Nodes
Entities in the run: agents, tools, models, data stores.
- Edges
Flow between them—the attack path is the highlighted red chain.
- Findings
OWASP / MITRE-style tags on the risky surfaces.
Intertrace fuses gateway telemetry, agent behavior, and data touch so you get one defensible view—not tickets plus raw logs. The canvas above is interactive and built from the product's own graph components, drawn with sample data.
+Integration
One integration. Full protection.
Point your client's base URL at Intertrace and use an Intertrace runtime key. Traffic hits the Intertrace-hosted edge and is classified from the first request.
from openai import OpenAI
import os
client = OpenAI(
api_key=os.environ["INTERTRACE_RUNTIME_API_KEY"], # itr_rt_*
base_url="https://intertrace.fly.dev/v1",
)Your AI is only as secure
as what watches it.
One agent. One ordinary Tuesday, watched twice: once without an authority layer, once with Intertrace seeing every event, session and decision.
+Intertrace Threat ResearchTLP:CLEAR
From the threat research desk
How the attacks against AI agents actually work, what they need to succeed, and the controls that break them. Public-source analysis, sourced claim by claim.
366 ways to make a destructive action look harmless
12 min read · Sam O.
Policy active is not an attack: the false positives that stop real agent work
12 min read · Sam O.
What deterministic layers catch on their own: a red-team baseline with the AI judge off
11 min read · Sam O.
Rules files and self-approval: how coding assistants get reconfigured by the code they read
9 min read · research desk
+ The AI watching your AI
Experience runtime agent security
Book a 30-minute risk assessment — or open the lab on a live path.