Altrace runs inside your agent's own pod, enforcing on both the request and the response across models and sub-agents. Stop unauthorized actions, cap spend, and maintain a tamper-evident audit trail.
In-pod deployment: Runs directly inside your agent's environment so no traffic leaves your infrastructure.
Sub-agent & model governance: Intercepts every request and response across external provider calls and self-hosted models.
Credential indirection: Issues virtual keys with hard spending limits and tool scopes so agents never hold your real API keys.
Works with every model you call or host. Enforces on every request and response.
Anthropic · OpenAI · Azure OpenAI · Google Gemini · AWS Bedrock · Self-hosted models · MCP · LangGraph · CrewAI
The governance gap
AI agents can
Most organizations cannot
88%
of organizations with AI agents have experienced a security incident
Gravitee 2026
14%
have full security governance over their AI agents
Gravitee 2026
73%
of CISOs cite AI agent risk as a critical concern
CSA 2026
One control layer, four jobs
01
See every agent, including the ones you never authorized. Shadow-agent detection the moment an unregistered agent sends its first request.
Platform overview →02
Declare what each agent is allowed to do, tools, models, destinations, actions, evidence prerequisites. Move beyond prompt-based controls.
Platform overview →03
Stop, limit, and govern every request below the application, where agents can’t bypass it. Kill switches, hard budgets, content governance.
Platform overview →04
Watch every decision, with a tamper-evident record of exactly what happened, cost, content, and action, attributable per agent.
Platform overview →The difference
Existing tools only see traffic that's routed to it. Altrace is injected into your agent's own pod, so it sees every local action, and every sub-agent your agent spawns, without a single packet leaving to an external hop. Your data never leaves your infrastructure, and every decision is written to a tamper-evident audit trail.
Credential indirection
Altrace issues each agent a scoped, revocable key of its own. The real provider key stays encrypted inside Altrace and is injected at the network boundary, so a compromised agent can never leak a key it never had.
Each agent gets a proxy-issued token, not your Anthropic, OpenAI, or Bedrock key. The real key is encrypted at rest and never reaches the agent process.
Lock a key to specific models, tools, endpoints, and a spending cap. A contractor’s agent cannot upgrade itself to a frontier model or call a tool it was never granted.
Revoke a key and the next request is refused, while the agent’s kill switch fires in the same action. Two independent stops, no grace period.
How credential indirection works →
The controls your security questionnaire asks about, mutual TLS, team-scoped RBAC, token revocation, IP allowlisting, and durable SIEM delivery, live on the platform page.
Data-flow governance
Altrace governs where data is allowed to go, so regulated or proprietary content never reaches a provider or endpoint you did not approve.
Allowlist the providers, endpoints, and tools each agent may reach. A prompt carrying regulated or proprietary data is blocked from any destination you did not approve.
Per-session data-flow labels keep data that one provider processed from crossing into another vendor inside the same session.
Classification returns yes or no labels, never extracted or stored text. Your data stays in transit between your agents and the model.