Six modules.
One governance layer.
Works with your stack.
Bastion Shield Bulwark gives every AI agent in your organisation an identity, a permission boundary, an audit trail, and an evidence record. It works alongside what you have already built, and it doesn't require replacing any of it.
It starts simple.
It never stays that way.
Nobody builds their own identity platform from scratch to manage employee logins. Your team uses an existing, trusted solution. The same logic applies to AI agents.
Building this layer in-house looks like a small lift on day one. A config file here, a wrapper service there. But governance infrastructure has to handle edge cases, the agent that goes rogue, the permission that gets inherited incorrectly, the log that needs to be produced six months after the fact. Those edge cases compound quickly.
By month twelve, you have an internal platform that your engineers have to maintain, document, audit, and improve, while also shipping the actual product. We've already built it. It's already been tested.
A YAML config and a couple of checks. Engineering thinks it'll take two weeks.
The security team asks for audit logs. The infra team asks about rate limiting. Two weeks becomes a backlog.
You have an internal governance microservice. Someone has to own it. It's not documented. The original engineer left.
ISO audit. They want evidence of access controls for your AI agents. Your internal tool can't generate it automatically.
Six modules. Each solves a real problem.
Know exactly which agent did what, and when.
The problem: Most teams deploying AI agents have no registry. Agents get spun up, hit production, and there's no canonical record of what they are, who owns them, or what they're supposed to do. When something goes wrong, and it will, there's no starting point for the investigation.
How it works: Every agent gets a cryptographically signed identity on registration. Name, owner, purpose, creation date, version. That identity travels with every action the agent takes. You can suspend it, rotate it, or permanently revoke it in one click.
- Unique agent IDs with cryptographic signing
- Lifecycle management: create, suspend, rotate, revoke
- Centralised agent registry with full inventory
- Programmatic registration via API and SDK
Agents should only touch what they need to touch.
The problem: An AI agent that can write to any database, call any API, and invoke any tool is a liability waiting to happen. Broad permissions aren't a feature, they're a risk. But manually managing permissions per agent doesn't scale, so most teams just leave everything open.
How it works: You define permission policies per agent. Read-only on the customer database. No access to HR records. This API only, not that one. Policies are enforced at runtime, not just declared in documentation. Just-in-time access requests give agents temporary elevated permissions with an approval step.
- Per-agent permission policies with fine granularity
- Database access scoping: read, write, or none per schema
- API allowlists and blocklists enforced at runtime
- Just-in-time access with human approval workflow
Evidence, not logs. Proof of why every consequential action was allowed.
The problem: A million log lines can still be a useless audit trail. When an auditor or a regulator asks why your AI was allowed to move money or export data, "here is a log" is not an answer. You need the decision, the evidence and policy that applied, who could have stopped it, and proof that none of it was altered after the fact.
How it works: Every consequential decision becomes a verifiable receipt: the initiating identity, the human it acted for, the policy and version applied, what the AI recommended, who had authority to approve, and the outcome. Each receipt is linked into a keyed hash chain, so any edit breaks the chain and is detectable. Verify the whole chain on demand, and still stream everything to your SIEM.
- Decision receipts: identity, policy, recommendation, authority, outcome
- Keyed HMAC hash chain, tamper-evident and verifiable on demand
- Two-identity model: the agent and the human it acted for
- Regulator-ready exports, still SIEM-compatible
Catches what rule-based systems miss.
The problem: An agent that behaves normally 99% of the time and then exfiltrates PII the other 1% is more dangerous than one that's consistently misconfigured, because you don't know it's happening. Static rules don't catch behavioural drift. By the time a conventional alert fires, the damage is done.
How it works: We build a per-agent behavioural baseline and watch for deviations with real statistical methods: seasonal-trend decomposition and robust z-scores for contextual anomalies, and CUSUM change-point detection for sustained behavioural shifts like scope creep or a compromised agent. The deterministic rules run inline and never wait on a model; the statistical layer is advisory. In our own benchmark the deterministic detector out-scored a trained isolation forest.
- Per-agent baselines: STL decomposition and robust z-score
- Change-point detection (CUSUM) for scope creep and compromise
- PII, credential, and API key leakage detection
- Deterministic rules inline; ML stays advisory, never blocks the gate
Evidence packages. Not evidence scrambles.
The problem: Compliance for AI systems is manual, slow, and happens at the wrong time: retrospectively, under pressure, when auditors are already in the building. Teams spend weeks pulling together evidence that should have been collecting itself. The result is incomplete, and the stress is real.
How it works: Bastion Shield maps your decision receipts, access records and risk events to named provisions: EU AI Act Articles 12, 14, 26, 26(5) and 50, and 17 NIST AI RMF subcategories. The pack shows what is evidenced, what is partial, and what is not covered, because AI RMF MEASURE 1.1 requires you to document what you are not measuring. When audit season arrives you export the pack in one click. This is evidence that supports your audits and reviews; using it does not by itself make you compliant with either framework.
- Evidence packs mapped to EU AI Act articles and NIST AI RMF subcategories
- Live control status: covered, partial, or a gap, with remediation
- GDPR Article 30 processing records for AI systems
- One-click export as JSON, as evidence that supports your audit
Find the AI you never sanctioned.
The problem: Most organisations cannot say what AI they are actually running. Agents, API keys, and tools enter through vendors, integrations, experiments, and individual employees. A spreadsheet inventory is stale the day it is written, and every unregistered agent is an ungoverned attack surface you cannot see.
How it works: Bulwark surfaces unregistered and unsanctioned AI from egress, OAuth grants, expense, and DLP signals, risk-scores each finding with its suspected owner and data access, and lets you triage in one click: register it into governance, quarantine it, or dismiss it. An unknown becomes a managed inventory.
- Discovery from egress, OAuth grants, expense, and browser DLP
- Risk-scored findings with suspected owner and data access
- One-click register into governance, quarantine, or dismiss
- Turns shadow AI into an inventory you actually control
From zero to governed in four steps.
Connect the SDK in minutes, watch your agents in monitor mode, tune your policies, then turn on enforcement when you are ready.
Connect the SDK
Add the Python or TypeScript SDK to each agent, or call the REST API. Register agents from the dashboard or the API. No infrastructure changes.
Watch in monitor mode
Bulwark records every action and decision and blocks nothing, so you see what your agents really do before any rule can get in the way.
Tune your policies
Set each agent's scope from the actions you recorded, and choose which actions need a person to approve them.
Enforce when ready
Turn on enforcement for the actions that matter once the flags make sense. Evidence builds up on the hash-chained trail from the first event.
Six risks. All avoidable.
These aren't hypothetical. They're conversations we've had with CTOs who found out the hard way.
Agent reads customer data it has no business reading
HIGHAccess Control Layer restricts data scope per agent
Audit asks why your AI was allowed to act. You can't prove it.
CRITICALDecision Receipts record the why, on a tamper-evident chain
Agent is compromised via prompt injection
HIGHRisk Detection flags injection patterns in real time
Nobody knows what AI is running across the business
HIGHShadow AI Discovery surfaces unregistered agents and keys
Agent shares PII or API keys via output
CRITICALRisk Detection catches leakage before it leaves
Your governance vendor goes down and takes your agents with it
HIGHThe SDK caches signed policies locally, so agents keep deciding at the edge
Ready to govern your agents?
We do a 30-minute architecture review. You show us your current agent setup, we show you exactly how Bulwark fits. No pitch deck.