Keep transfers within policy.
Define which destinations an agent may send data to. Deny transfers outside those boundaries.
AI AGENT CONTROL INFRASTRUCTURE
YOUR AGENTS. YOUR RULES.Control what your
AI agents can do.
Before an action reaches your systems.SANSAR sits between AI agents and your organisation’s systems. It checks protected actions against your policies, blocks requests that fail and requires the approvals your rules specify. Monitor activity, use the kill switch to stop governed agent execution and inspect cryptographically signed records.
Request a demo See the control in action01 Enforce your policies02 Require human approval03 Verify the evidence
An AI agent is software that can take actions for you, such as sending a file or updating a system.
SEE WHAT HAPPENS BEFORE AN AGENT ACTSILLUSTRATIVE DEMO · NO REAL DATA
01 / YOUR AGENT ASKS
Sales operations agent
“Send this customer list to a new supplier.”
CUSTOMER EXPORTcustomers.csv
| customer_id | region | |
|---|---|---|
| CUS_1042 | ••••@•••• | EU |
| CUS_1043 | ••••@•••• | EU |
| CUS_1044 | ••••@•••• | EU |
ILLUSTRATIVE PAYLOAD↗
ACTION REQUEST
02 / SANSAR CHECKS
SSANSARAUTHORITY
BEFORE EXECUTION
BEFORE EXECUTION
Agent identityRecognised
Action contextEvaluated
Permitted regionOutside scope
DATA SOVEREIGNTY RULE
DENY
EU-only data cannot go to this US destination
POLICY OWNERData owner
03 / THE RESULT
CONNECTED SYSTEM
Supplier / US
Requested destination
TRANSFER DENIED
Access to a tool does not mean every action is allowed.
DATA / 001
This example denies a transfer outside the permitted region. Human approval cannot override this rule.
How SANSAR worksFor teams putting AI agents into production.
Data sovereigntyHuman approval & kill switchCryptographic evidenceWHEN YOU NEED SANSARBEFORE AGENTS GET PRODUCTION ACCESS
Your agent is ready.
Are its permissions?
For enterprise and public-sector teams deploying agents that handle sensitive data or change live systems. Start with the actions your organisation needs to control.
Control changes to live systems.
Specify which actions may run automatically and which require approval before execution.
Review the decision and evidence.
Inspect the policy, approvers and signed records associated with a protected action.
Where SANSAR fits
Your identity system establishes access. SANSAR checks protected actions at runtime against your policies and approval requirements. Your monitoring and audit tools remain part of the wider control environment.
Review the integration model01 / HOW SANSAR WORKSSET RULES → CHECK THE REQUEST → ALLOW, HOLD OR DENY
Your agent asks.
Your rules decide.
SANSAR sits between AI agents and your organisation’s systems. Deterministic runtime checks allow permitted actions, hold requests for required approvals and deny actions that fail your rules. An AI model does not make the policy decision.
01
AGENT MONITORINGMonitor agent activity.
Monitor agent activity. Identify who requested an action and which permissions they used.
02
RUNTIME POLICY & SOVEREIGNTYEnforce the boundary.
Apply explicit rules to protected actions and data destinations. If required conditions are not met, the action does not proceed.
03
HUMAN OVERSIGHTRequire the right approval.
Send requests to the people authorised to approve them. Use the kill switch to stop execution across all agents governed by SANSAR.
04
CRYPTOGRAPHIC EVIDENCECheck the evidence.
Check signed, tamper-evident records. Trace the request, policy decision, approvals and execution evidence within the attested workflow.
AGENT REQUESTSANSAR YOUR RULES + APPROVALSBUSINESS SYSTEM
A protected action is one routed through SANSAR’s enforcement. Deployment review must cover direct access, credentials and onward calls through other services.
Review a workflow before giving an agent production access.
Request a demoWHY SANSARPOLICY CHECKS BEFORE EXECUTION
Your data has boundaries.
Your agents must too.
An agent’s access to data is not permission to send it anywhere. SANSAR checks the requested destination against your policy before a protected transfer proceeds.
ONE WORKFLOW / CUSTOMER DATA“Send this customer list
“Send this customer list
to our new supplier.”
The agent has access to the file. Your rule allows this data to go only to approved EU destinations. The requested supplier is in the US.
DENYDestination outside the permitted region
Illustrative policy example. No transfer is performed.Where is it going?
Check the destination and its region against your data rules. Access to the file does not authorise an international transfer.
Who can authorise it?
Where your policy permits an exception, require approval for that specific action. Approval does not override a rule that forbids the transfer.
What can you prove?
Review the request, rule version and decision. Compare them with the receiving system’s records to check the actual result.
Evaluate the control on your workflow.
Test an approved destination, a forbidden region, a changed request and revoked access. Inspect the decision and the receiving system’s evidence.
Data sovereignty also depends on processing locations, storage, model providers and subprocessors. Confirm which paths are connected and controlled during evaluation. Deterministic decisions depend on the policy, inputs and state supplied to the check.
A PAYMENT REQUEST, FROM START TO FINISHILLUSTRATIVE WORKFLOW
Before the money moves,
check every approval.
Example: an agent requests a payment to a new beneficiary. Policy requires a finance approval before execution. Review the request, checks, approval and result together.
- 01 / OBSERVE
Identify the agent.
Identify the requesting agent and the permissions it is acting under.
REQUEST - 02 / EVALUATE
Apply the rules.
Check the amount, beneficiary and relevant data boundaries against policy.
POLICY - 03 / AUTHORISE
Follow the approval chain.
Require the designated finance approver. A changed request needs a new check.
APPROVAL - 04 / ENFORCE
Control execution.
Proceed only when all required conditions are satisfied. Otherwise, keep the action blocked.
EXECUTION - 05 / VERIFY
Inspect the evidence.
Check the cryptographic record and reconcile the result with the payment system.
ATTESTATION
Missing approval? The payment stays blocked.
Attestation scope and downstream confirmation are established for each integration.
02 / WHY IT MATTERSWHAT WENT WRONG. WHAT NEEDS A CHECK.
An AI mistake can
become a business incident.
A request can come from an authorised agent and still delete the wrong data or disclose information. These examples explain why access permissions need action-level controls.
OPERATIONAL FAILUREJUL 2025
ReplitAn agent deleted production data.
Replit confirmed that its agent deleted data from Jason Lemkin’s app database. The database was restored; Replit subsequently separated development and production databases by default.
Control the action before it reaches production.
Read Replit’s accountDISCLOSED VULNERABILITYCVE-2025-32711
EchoLeakAn email became a route to data.
The EchoLeak case study describes a zero-click prompt injection vulnerability in Microsoft 365 Copilot that could exfiltrate data through a crafted email. The vulnerability was patched.
Check where data goes, even when the agent is trusted.
Read the published case studyREPORTED THREAT CAMPAIGNNOV 2025
AnthropicAgents were used to execute attacks.
Anthropic reported a campaign that used Claude Code to attempt intrusions into roughly 30 targets, including businesses and government agencies, with success in a small number of cases.
Constrain tool authority and inspect the execution path.
Read Anthropic’s reportThese are separate incidents, disclosures and provider reports. They illustrate failure modes; they are not SANSAR customer stories or tests of SANSAR’s effectiveness.
03 / CRYPTOGRAPHIC PROOF & ATTESTATION
Check the record.
Detect changes.
Cryptographic verification checks whether a signed record has changed. End-to-end attestation connects evidence across the stages covered by an integration.
Inspect the agent identity, policy version, approvals and execution evidence. Each integration must specify which stages are attested and how the downstream result is confirmed.
See how a record is checkedThe verification example performs a real browser signature and tamper test on synthetic data.
DECISION TRACEILLUSTRATIVE / UNSIGNED
REQUESTR-00184DENY
01Who requested it?sales-agent-07+
Identify the agent and the person or service that delegated its authority.
02What was requested?file.export → supplier / US+
Bind the action, resource and destination to the same request.
03Which rule applied?eu-only-destinations.v3+
Retain the policy version and the conditions evaluated at decision time.
04Could approval override it?No exception permitted by this rule+
This example prohibits the destination. A human approval does not turn the denied request into a permitted one.
05What decision was recorded?DENY / destination not permitted+
Compare the decision with independent tool or destination records. A decision record alone does not prove the business effect.
REQUESTDECISIONDESTINATION EVIDENCE
04 / REGULATION & ASSURANCEREQUIREMENTS MUST BECOME CONTROLS.
Turn AI policies
into everyday checks.
AI governance means deciding how AI is used and showing that those decisions are followed. Use these sources to plan your AI compliance assessment and the evidence it requires.
EU REGULATION
EU AI Act
For high-risk systems, the Act sets requirements covering logging, documentation, human oversight, robustness and cybersecurity.
CONTROL QUESTIONSCan you trace the action?
Can a person intervene?
European Commission Can a person intervene?
VOLUNTARY FRAMEWORK
NIST AI RMF
Govern, Map, Measure and Manage provide a framework for ongoing AI risk management across the system lifecycle.
CONTROL QUESTIONSWho owns the risk?
How is the control evaluated?
NIST AI Resource Center How is the control evaluated?
SECURITY GUIDANCE
OWASP
Excessive agency includes too much functionality, permission or autonomy. OWASP recommends downstream authorisation and approval for high-impact actions.
CONTROL QUESTIONSIs the tool call authorised?
What can bypass the check?
Excessive agency guidance What can bypass the check?
Applicability depends on the system, use case, organisational role and jurisdiction. These sources inform a control assessment; they do not establish product certification or an organisation’s compliance.
05 / TECHNICAL DUE DILIGENCEARCHITECTURE, COVERAGE AND EVIDENCE
Inspect the controls.
Test them on your workflow.
Before deployment, review supported execution paths, failure behaviour and evidence coverage with your platform, security and governance teams.
01 / SECURITY & ASSURANCE
Understand what is covered.
Which tools are controlled, what happens when something fails and what to test.
Review the trust guide 02 / ARCHITECTURESee how it connects.
Review integration approaches and the checks needed for your agents and tools.
Explore the developer overview 03 / EVIDENCEChange a record. Verify it.
A working signature example with explicit integrity and evidence limits.
Run the browser exampleCOMMON QUESTIONS
Before your
next deployment.
What is AI agent control infrastructure?+
SANSAR provides runtime control over protected agent actions: monitoring, deterministic policy enforcement, data sovereignty, human approval chains and cryptographically verifiable evidence. It supports AI governance and assurance while complementing an organisation’s cybersecurity tools.
Can we stop all agents at once?+
SANSAR includes a kill switch for all agents under its control. Use it to stop governed agent execution when intervention is needed. Confirm how each integration handles actions already in progress; stopping execution does not reverse actions already completed.
Does every agent action pass through SANSAR?+
Coverage is defined by the deployment. Complete mediation requires every route to a protected action to be checked, including calls through intermediary services. Review network paths, credentials and downstream access before claiming that an agent cannot bypass enforcement.
What does cryptographic proof establish?+
Signature verification can establish record integrity and association with a signing key. End-to-end attestation must identify the stages, identities and execution evidence it covers. A valid signature alone does not prove that an action was safe, that every event was recorded or that a downstream operation succeeded.
What is AI agent security?+
AI agent security addresses the tools, credentials, data and actions available to an agent, including the consequences of prompt injection or excessive permissions. SANSAR focuses on policy and human authority at connected action boundaries.
Does SANSAR use AI to decide whether an action is allowed?+
No. SANSAR uses deterministic policy checks. The decision follows explicit rules applied to the request and the relevant state, including permissions and approvals. An AI model does not judge whether another agent should be allowed to act. Coverage still depends on connecting the execution paths and preventing direct access around the control.
How does SANSAR support data sovereignty?+
Set rules for approved data destinations and regions, then check agent requests against those rules on connected routes. Review where data is processed and stored across the wider system as well, including model providers and subprocessors. A destination check alone does not establish sovereignty for every part of a deployment.
How does runtime AI governance work?+
Runtime governance applies rules to an actual action request: who is acting, what they want to do, which data or destination is involved and whether approval is required. It complements the policies and risk processes maintained by the organisation.
What should an AI audit trail contain?+
An evaluation should connect request identity, action, resource, destination, policy version, human approval and observed result. Review coverage and reconcile decisions with destination records; a signature alone does not establish that an action was enforced.
Does SANSAR establish AI compliance?+
Compliance depends on the full system, use case, legal role and applicable requirements. A runtime control can form part of a wider governance programme. Assess the obligations and evidence for the complete deployment.
REQUEST A DEMO
Bring a workflow.
See the checks.
Bring one agent workflow and the systems it needs to reach. Use the walkthrough to assess policy enforcement, approval chains, data boundaries and evidence coverage before a deployment decision.
01 Map the agent, systems and permitted actions.
02 Walk through allowed, held and denied requests.
03 Review integration scope and acceptance tests.