Jozu Agent Guard secures AI agents on your own Kubernetes clusters by starting with the AI supply chain. Every agent ships as a signed KitOps ModelKit, gets scanned in Jozu Hub, is admitted only if it meets your policy, and then runs in its own microVM with tool policy enforced locally and every decision written to a signed audit log. Agent Guard installs on your own machine for free.
Most agent security starts at runtime. We think that's too late, because by then you're trusting something you can't describe. Agent Guard starts earlier.
What is Jozu Agent Guard?
Jozu Agent Guard is the umbrella for two products that share one policy engine.
- Jozu Agent Enclave runs each agent (or each multi-agent workflow) inside its own hardware-isolated microVM, on Kubernetes or on your machine.
- Jozu Policy Gateway sits on the device and checks prompts, attachments, and completions against your policy before anything leaves.
Both are part of the Jozu platform, which we describe as the Fail-Safe for Enterprise AI.
Why start with the AI supply chain instead of runtime?
An agent is more than a model. It's a model plus prompts, skills, MCP servers, and the policies meant to constrain it. If any of those pieces can change without anyone noticing, runtime controls are guarding something nobody actually reviewed.
So before an agent runs, Agent Guard can tell you what went into it, who touched it, and whether it was scanned before it reached production. That answer comes from signatures and attestations, not from a spreadsheet.
How does Agent Guard work, step by step?
1. Package the agent as a signed ModelKit
With KitOps, a CNCF project, you import a model (for example kit import hf://org/model), then kit pack the model, prompts, skills, MCP servers, and policies into one ModelKit. A ModelKit is an OCI artifact, so it has one digest and can be signed with cosign.
2. Push it to Jozu Hub for scanning
kit push sends the ModelKit to Jozu Hub, which scans it for malicious code, backdoors, data poisoning, adversarial gaps, prompt injection, sensitive data leakage, content safety, license issues, and dependency vulnerabilities. Results are attached to the artifact as signed attestations.
3. Admit only what your policy allows
On the cluster, an ArtifactPolicy decides what is allowed to start. Anything unsigned, or missing the attestations your policy requires, is denied at admission and never starts.
4. Run every agent in its own microVM
Admitted agents run inside Agent Enclave, with a microVM per agent and its own kernel. A compromised or confused agent is contained to what that microVM can reach.
5. Enforce tool policy and record every decision
A ToolPolicy is enforced locally, beside each agent. If an agent tries something like shell.exec 'rm -rf /data', the policy denies it before it runs. Every allow, deny, and prompt for approval is written to a signed audit log you can hand to whoever needs proof.
Does it work on air-gapped Kubernetes?
Yes. Policy is enforced locally, inside the cluster, so enforcement does not depend on reaching Jozu Hub or any outside service. That's why Agent Enclave on Kubernetes fits on-prem and air-gapped environments, which is where we see the hardest version of this problem.
Where does Policy Gateway fit?
Policy Gateway is the easiest place to start. It installs on a single machine and keeps sensitive data from leaving for ChatGPT, Claude, or AI APIs, using the same policy engine as Agent Enclave. A shared-network version of Policy Gateway is on the roadmap.
What does Agent Guard not do?
We'd rather say this plainly.
- It does not eliminate prompt injection. No tool can. It limits what a manipulated agent can reach and do.
- It does not replace mTLS between agents, network intrusion detection, or model behavior monitoring.
- In gateway-only deployments, tool policy does not cover an agent's built-in tools. That requires Agent Enclave.
Agent Guard is one layer of a layered model.
FAQ
What is a ModelKit? A ModelKit is the KitOps packaging format. It bundles models, data, code, prompts, and config into one OCI artifact that any OCI registry can store and cosign can sign.
Do I have to use Jozu Hub? KitOps is open source and works with any OCI registry. Jozu Hub adds scanning, signed attestations, and the policy that Agent Enclave uses at admission.
Do my agents need to be modified? No. Agents run unmodified inside the microVM.
Is Policy Gateway free? Yes, the desktop install of Policy Gateway is free.
Talk to us about Kubernetes
If you run AI on your own Kubernetes, connected or air-gapped, talk to us about Kubernetes. Want to see it on your own machine first? Try Policy Gateway.