Agents take actions.
Agent Guard governs them.
Jozu Agent Guard enforces your AI policy on the devices your people use, on the laptops your engineers code from, and inside the clusters where your production agents run. It is one policy engine on all of them, enforced locally on the machine itself, and it keeps working whether or not that machine can reach the network.
Works with Claude Code, Cursor, and Codex, alongside ChatGPT, Claude, and the AI APIs your teams are already calling.
Agent Guard secures and governs your AI wherever it runs.
AI is everywhere. Your team accesses it in browser tabs, desktop apps, and command-line tools, while your engineers build and run agents of their own on laptops or inside Kubernetes clusters. Each of those has unique security risks, assumptions about who owns them, what they are allowed to touch or share, and what policies should be enforced. Agent Guard gives you the ability to govern production AI wherever it runs. Verify what you ship, enforce what it can do, and prove every action with a tamper-evident record.
Secure and contain multi-agent workflows on Kubernetes.
Deploy fully secured and verified agents, MCP servers, and policies in a microVM through Jozu's governance control plane. Agents arrive scanned and signed, with verified provenance. Nothing starts until it has been verified, and your policies are enforced for tool use, data access, and egress control.
Contain agents running on endpoint devices.
Wrap personal agents like Claude Code, Cursor, and Codex inside an isolated microVM that sees only the workspace, files, MCPs, and agents you share. Every tool call is checked against your policy and the blast radius is limited to what is inside of the microVM.
Enforce your policies on shared LLMs and agents.
When a team, a site, or a whole cluster all share and reach the same LLM or agent applications, our Network Policy Gateway can be installed on the shared path, so every request meets the same policy and lands in the same audit log regardless of who sent it.
Enforce your policies on hosted, SaaS, and desktop LLMs.
Your team pastes contracts into ChatGPT and attaches spreadsheets to Claude. Policy Gateway reads those prompts, attachments, and completions on the device itself, and blocks or redacts whatever your policy forbids before any of it leaves. There is no SaaS dependency, and it works online or offline.
Contain and govern every agent.
Agents edit files, run commands, and reach the network with real credentials, whether that is on an engineer's laptop or on a node in your cluster. Agent Enclave gives each agent a kernel-isolated microVM with its own policy engine, so what an agent can do is only what you predefine.
On your machine
Your engineers are already running Claude Code, Cursor, Codex and custom agents in YOLO mode. Agent Enclave secures the agent inside a microVM limiting access to approved files, tools, and credentials. The agents need no modification, no Docker prerequisite, and it installs as a single download.
- The agent only sees the workspace you mount, and your home directory, SSH keys, and browser sessions stay out of it by default.
- Tool calls and network access are checked before they run, and your policy decides whether to enforce, ask a human, or audit.
- Agents that go rogue can't escape the VM, and a kill switch can instantly block all network egress.
On Kubernetes
Agent Enclave runs on your Kubernetes cluster in its own microVM, with its own kernel. Policies have fine-grained controls: approve an MCP server while blocking a specific MCP or harness tool. Agents that go rogue can't escape the VM, and a kill switch can instantly block all network egress.
- Works with any agent and any harness, even custom agents.
- Agents, MCP servers, and policies arrive from Jozu Hub as signed, SHA-verified OCI artifacts, and policies prevent starting unapproved or dangerous artifacts.
- Every decision from every agent lands in a chained audit log that syncs back to Jozu Hub.
The installer lets you choose Policy Gateway, Agent Enclave, or both.
Turn off the permission prompts. Keep the walls.
Govern the AI your organization already uses.
For SaaS AI, Agent Guard's policy engine sees every prompt and response, and processes attachments for sensitive data and policy violations. Agent Guard reads and understands the semantic meaning so it can block dangerous or sensitive information to trusted AI, not just block untrusted AI.
On the device
Policy Gateway captures AI-bound connections and interactions on the device, enforcing your defined policy on the machine, so inspection happens locally and prompt content never passes through a third-party cloud.
- Fleet View in Jozu Hub shows every device running Agent Guard, the policy versions applied to it, and whether it is currently connected.
- Every policy decision writes to a tamper-evident, cryptographically chained audit log that syncs to Hub when the device is online and keeps recording when it is not.
- Missing data or an evaluation error denies the action rather than allowing it, so a policy that cannot be evaluated is never quietly skipped.
On a shared network
When many people reach the same LLM application, Policy Gateway can sit on that shared path instead of on each device, so one policy governs every request to the application and every decision lands in the same audit log.
- The same policy definitions you already run on devices, so there is no second policy system to author or maintain.
- Every request from every person lands in one chained audit log, so a shared application has a single record instead of one per device.
- Designed to operate at scale, each policy decision is evaluated in micro-seconds, so policy enforcement does not impact time to response.
Write a policy once. Enforce it everywhere it applies.
Policies are short YAML files with CEL assertions, distributed as signed OCI artifacts and verified locally on the machine that enforces them. The same GuardrailPolicy and ToolPolicy definitions behave the same way on a device and inside an agent's microVM, so there is no seam between the AI your people reach and the AI you run yourself.
| Policy | Jozu Policy Gateway | Jozu Agent Enclave |
|---|---|---|
| GuardrailPolicy: prompts and completions | Yes | Yes, protect sensitive data |
| ToolPolicy: tool calls | MCP servers configured to use the gateway | Yes, MCP and agent harness tools |
| ArtifactPolicy: what may load and run | Not applicable | Yes, block risky and unapproved agents |
| Chained audit log | Yes | Yes, feed to SIEM, or use as evidence |
| Enforces with no connection to Jozu Hub | Yes | Yes, all policy is evaluated locally and offline |
| Fails closed on missing data or errors | Yes | Yes, prevents silent risks |
Policy actions: Enforce blocks the call, Elicit asks a human first, Audit allows it and logs it.
Before it runs, while it runs, and the proof underneath both.
Verify: Jozu Hub.
Jozu Hub scans every model, agent, and MCP server across nine vulnerability classes before any of it runs, and attaches the results to the artifact itself as signed attestations, so only what passes your policy is ever distributed.
Enforce: Jozu Agent Guard.
Policy Gateway and Agent Enclave govern what your AI does while it runs, on the device, on the laptop, and in the cluster, with every decision enforced locally on the machine itself.
Prove: one audit record.
One tamper-evident, cryptographically chained log spans the AI supply chain and the runtime, so you can trace any agent action back to the policy that governed it and the artifact that produced it.
Jozu is built by the creators of KitOps, a CNCF project, and the authors of the CNCF ModelPack specification. Everything Agent Guard pulls is an OCI artifact, so it works with the registries and the clusters you already run, including a private Hub deployed inside an air-gapped network.
Where other approaches stop.
Sandboxes, MCP gateways, and guardrail libraries each cover part of the path your AI takes, and none of them cover all of it. These are categories rather than specific products, and individual tools vary.
| Capability | Container sandboxes | MCP gateways | Guardrail libraries | Jozu Agent Guard |
|---|---|---|---|---|
| Per-agent kernel isolation | Shared kernel by default | Own microVM per agent | ||
| Content-aware inspection | MCP traffic only | Text only | LLM and MCP traffic, on the device and in the VM | |
| Artifact verification before run | Container images only | Signed agents, MCP servers, and policies, gated by ArtifactPolicy | ||
| Central Policies Locally Enforced | Yes | |||
| Block unsafe agents/MCPs before run | Partial | All artifacts scanned for AI specific vulnerabilities and blocked from load |
Try it on your machine.
One command installs Agent Guard on your machine. Start from a pre-built policy and you will see your first blocked action in minutes.
The installer lets you choose Policy Gateway, Agent Enclave, or both.
Your agents are already taking actions. Decide which ones run.
One policy engine, enforced on the device, on the developer laptop, and inside every agent's microVM. It is centrally managed, locally enforced, and out of the agent's reach.