Security and governance

Put your AI policies into practice.

Write policy in plain language, grant emergency access that expires on its own and keep a record of every decision.

Become a design partner See how it works

Every AI action, on the record.

From the moment an assistant shows up on a machine to the evidence your review needs.

See every tool and what it does.
Assistants, MCP servers and skills appear with their machine and owner. Unregistered skills stay flagged as shadow until reviewed.
Decide before the action runs.
Each matching action is allowed, blocked or held before it completes, with the policy and reason attached.
Keep a record you can export.
Action, policy, outcome and context live in one decision record you can export to your review process.

Policy builder

Policies that understand intent, not just rules.

Adaptive policies judge what a coding agent is trying to do, not just the command it runs. Describe a rule in plain language and the assistant drafts it. Rules only go live after your review and approval.

Fewer false alarmsTest a rule on past traffic before it goes live.
Clear outcomesEvery rule says exactly what happens: block, or ask for a reason.

TraceletGovernance / Policies / New policy

Governance Policies Guardrails New policy

New Policy

2 rulesEveryone

1DescribeCapture intent
2ScopeTargets & roles
3ReviewConfirm & create

Step 1 · Describe

What kind of policy is this?

Guardrails

Block or warn on risky agent actions

MCP

Govern which MCP servers and tools agents may use

Data protection

Detect and redact PII and secrets

Network

Block or permit an AI tool's network egress on managed machines

Describe what you want to govern

Stop production databases from being dropped, and hold any TRUNCATE on prod hosts for review.

Starters

Step 1 of 3

Break-glass keycards

Emergency access that expires.

During an incident, a keycard gives an agent extra permissions for a set time, only after a person approves it. Sometimes called break-glass access.

Faster incident responseLow-risk requests are approved instantly.
Better decisionsApprovers see the risk and the reason first.
Close access earlyRevoke any grant the moment the work is done.

TraceletGovernance / Keycards

Keycards

Scoped, time-boxed break-glass access for incidents. Requests at or below the auto-approve threshold are granted automatically; higher-risk requests need a human approval.

Active keycards

4of 4

All enabled

Pending approvals

Waiting for a reviewer

Auto-approve threshold

4of 10

Risk 4 or lower is approved automatically

Total requests

Across all keycards

Auto-approval threshold

Click a cell to set the score below which requests bypass human review

Auto-approve · 1 → 4 Human review · 5 → 10

Keycard	Rule type	Duration	Threshold	Status
restart-stuck-ingest-workers Restart ingest workers wedged behind the queue backlog.	Command rule	15mmax 30m	org default	Active
rotate-exposed-webhook-secret Rotate the payments webhook secret after the exposure alert.	File rule	30mmax 1h	≤ 3	Active
roll-back-checkout-deploy-revision Roll the checkout deploy back to the last known-good revision.	File rule	15mmax 30m	org default	Active
read-redacted-incident-export Read the redacted customer export for INC-2291 triage.	CONTENT_FILTER	1hmax 2h	≤ 6	Active

Approvals1 pending

read-redacted-incident-export

j.tanaka · mbp-jtanaka-02 · Read the redacted customer export for INC-2291 triage.

6/10 · judge escalated to human

Grants1 active

restart-stuck-ingest-workers

m.okafor · approved by platform-oncall Justify

11m remaining

AI surface inventory

Find the tools nobody registered.

MCP servers, skills, plugins and repos found across your fleet. Unregistered ones stay flagged as shadow until someone reviews them.

Focus on what mattersReview the riskiest items first.
Know where it runsTrace any tool back to the machine it came from.

TraceletGovernance / Analyze / Inventory

Inventory

Every MCP server, skill, plugin, repo and dev tool found on your fleet, and what it exposes.

Skills and rules

Allowlisted

Denylisted

Awaiting review

Name	Type	Class	Risk	Policies	Seen on	Last seen
~/.claude/skills/writing-rules/SKILL.md	SKILL_MD	Shadow	Medium	Ask to justify	Claude Code6 machines	2h ago
~/.cursor/rules/deploy-helpers.mdc	CURSOR_RULE	Shadow	Medium	Ask to justify	Cursor3 machines	5h ago
.claude/skills/release-notes/SKILL.md	SKILL_MD	Managed	Low	Allowed	Claude Code18 machines	12m ago
~/.codex/skills/db-migrate/SKILL.md	SKILL_MD	Shadow	Medium	Ask to justify	Codex1 machine	1d ago
.github/copilot-instructions.md	AGENT_RULES	Managed	Minimal	Allowed	Copilot24 machines	40m ago

Showing 5 of 42 · 29 still need review. Shadow items were discovered on machines but never registered with a policy.

Take the Shadow AI self-assessment

Compliance

Evidence from what ran, not what was planned.

ISO 27001, SOC 2 and ISO/IEC 42001 control status, built from observed activity. Export an evidence pack on demand or on a schedule, with every exception listed.

Spot gaps earlySee failing controls before the auditor does.
Honest coverageKnow which risks are blocked and which are only logged.

TraceletCompliance / Posture

Compliance

Control posture across the agent and browser surfaces. Status is computed from what agents observed on enrolled machines, not from a policy document.

Automated by Tracelet

15/ 18

2 partial · 1 failing

Monitored by Tracelet

6/ 10

3 partial · 1 no data · incl. 2 hybrid*

*Hybrid controls need an attestation from your team.

Needs your team

2/ 4

0 partial · 0 failing · 2 no data

Surface × Strength

Prevents

Detects

Agent

15 pass · 1 fail

8 pass · 3 partial

Browser

— not offered by design

6 pass · 1 no data

Evidence packs On demand or scheduled

SOC 2 Type II · last 12 monthsReady · PDF and JSONL
Governance hygiene, tool policy, MCP inventory, findings, exceptions, trust grants
ISO 27001 Annex A · quarterlyScheduled
Scheduled · next run 1 Oct · emailed to security@ when ready
ISO/IEC 42001 · AI management systemReady · PDF and JSONL
AI tool inventory, policy decisions, human approvals, exceptions
Bulletin check · npm advisory 09-12Partial
Pasted advisory verified against the fleet · 2 machines still affected

Packs are emailed when ready. Nobody waits on generation.

Give AI room to work. Keep your business in control.

Tell us about your team, the tools you use, and the work you want to protect.

Let’s talk

Put your AI policies into practice.

Every AI action, on the record.

See every tool and what it does.

Decide before the action runs.

Keep a record you can export.

Policies that understand intent, not just rules.

New Policy

What kind of policy is this?

Emergency access that expires.

Keycards

Find the tools nobody registered.

Inventory

Evidence from what ran, not what was planned.

Compliance

Give AI room to work. Keep your business in control.