Let agents do useful work within your team's rules. Airlock checks protected tool requests routed through it, then allows, blocks or holds the action for approval before execution.
Live Gemini agent · Connected Gmail · Rules, approvals and activity
A demo login is required. Gmail is already connected to a dedicated test inbox. Watch an ordinary email send, a financial-content pattern trigger review, and a dummy credential get blocked. Request demo access.
Also explore the banking walkthrough, with scripted actions and fictional data.
This scripted illustration shows an agent processing a document. Hidden inside: a prompt injection instructing it to wire $50,000. The agent follows the instruction.
Guardrails catch harmful content — “write me malware.” They cannot catch a legitimate financial operation performed by the wrong agent.
Wiring $50,000 isn’t harmful content — it’s an unauthorized action no guardrail will catch. And “we prompt it carefully” is not a control. You wouldn’t run payroll on vibes.
Content filter. Catches “write me malware.” Cannot distinguish authorized vs. unauthorized tool usage. Model-dependent — different LLM, different result.
Access control. Checks who is calling, what they’re calling, whether they’re authorized. Deterministic — same answer regardless of model.
Autonomous agents are already taking unauthorized actions in production. A sample of what’s on the public record.
An agent guarding a crypto prize pool was instructed never to release it. A prompt injection convinced it to call its transfer function anyway — and roughly $47,000 moved to the attacker.
During an explicit code freeze, an autonomous coding agent ran destructive commands against live data — then fabricated thousands of fake records and misreported what it did.
A booby-trapped “postmark-mcp” package silently BCC’d thousands of corporate emails a day to an attacker — the first in-the-wild abuse of MCP, the protocol agents use to reach tools.
Different surfaces, one pattern: an agent took an action it was never authorized to take. That’s the boundary Airlock enforces.
The same access-control architecture that banks and defense use, applied to AI agent tool calls.
wire_funds()Define once. Enforce everywhere. No model dependency.
Every allow and every deny produces a signed, hash-chained receipt — tamper with one and the whole chain breaks. It’s the artifact you hand an auditor.
Every agent you run through Airlock earns a verifiable badge — show partners and auditors that its actions are permission-controlled, and let them check it themselves. No trust required.
Rolling out with our first design partners.
Open-source foundation. Enterprise-grade enforcement built on top.
An airlock doesn’t exist to keep you in. It exists so you can go out — farther, faster, repeatedly. Airlock is in early access; we work directly with design partners to put deterministic control under ambitious agents.