Six modules.
One governance layer.
Works with your stack.
BastionShield Bulwark gives every AI agent in your organisation an identity, a permission boundary, an audit trail, and a compliance record. It takes days to deploy. It doesn't require replacing anything you've already built.
It starts simple.
It never stays that way.
Nobody builds their own identity platform from scratch to manage employee logins. Your team uses an existing, trusted solution. The same logic applies to AI agents.
Building this layer in-house looks like a small lift on day one. A config file here, a wrapper service there. But governance infrastructure has to handle edge cases, the agent that goes rogue, the permission that gets inherited incorrectly, the log that needs to be produced six months after the fact. Those edge cases compound quickly.
By month twelve, you have an internal platform that your engineers have to maintain, document, audit, and improve, while also shipping the actual product. We've already built it. It's already been tested.
A YAML config and a couple of checks. Engineering thinks it'll take two weeks.
The security team asks for audit logs. The infra team asks about rate limiting. Two weeks becomes a backlog.
You have an internal governance microservice. Someone has to own it. It's not documented. The original engineer left.
ISO audit. They want evidence of access controls for your AI agents. Your internal tool can't generate it automatically.
Six modules. Each solves a real problem.
Know exactly which agent did what, and when.
The problem: Most teams deploying AI agents have no registry. Agents get spun up, hit production, and there's no canonical record of what they are, who owns them, or what they're supposed to do. When something goes wrong, and it will, there's no starting point for the investigation.
How it works: Every agent gets a cryptographically signed identity on registration. Name, owner, purpose, creation date, version. That identity travels with every action the agent takes. You can suspend it, rotate it, or permanently revoke it in one click.
- Unique agent IDs with cryptographic signing
- Lifecycle management: create, suspend, rotate, revoke
- Centralised agent registry with full inventory
- Programmatic registration via API and SDK
Agents should only touch what they need to touch.
The problem: An AI agent that can write to any database, call any API, and invoke any tool is a liability waiting to happen. Broad permissions aren't a feature, they're a risk. But manually managing permissions per agent doesn't scale, so most teams just leave everything open.
How it works: You define permission policies per agent. Read-only on the customer database. No access to HR records. This API only, not that one. Policies are enforced at runtime, not just declared in documentation. Just-in-time access requests give agents temporary elevated permissions with an approval step.
- Per-agent permission policies with fine granularity
- Database access scoping: read, write, or none per schema
- API allowlists and blocklists enforced at runtime
- Just-in-time access with human approval workflow
Evidence, not logs. Proof of why every consequential action was allowed.
The problem: A million log lines can still be a useless audit trail. When an auditor or a regulator asks why your AI was allowed to move money or export data, "here is a log" is not an answer. You need the decision, the evidence and policy that applied, who could have stopped it, and proof that none of it was altered after the fact.
How it works: Every consequential decision becomes a verifiable receipt: the initiating identity, the human it acted for, the policy and version applied, what the AI recommended, who had authority to approve, and the outcome. Each receipt is linked into a keyed hash chain, so any edit breaks the chain and is detectable. Verify the whole chain on demand, and still stream everything to your SIEM.
- Decision receipts: identity, policy, recommendation, authority, outcome
- Keyed HMAC hash chain, tamper-evident and verifiable on demand
- Two-identity model: the agent and the human it acted for
- Regulator-ready exports, still SIEM-compatible
Catches what rule-based systems miss.
The problem: An agent that behaves normally 99% of the time and then exfiltrates PII the other 1% is more dangerous than one that's consistently misconfigured, because you don't know it's happening. Static rules don't catch behavioural drift. By the time a conventional alert fires, the damage is done.
How it works: We build a per-agent behavioural baseline and watch for deviations with real statistical methods: seasonal-trend decomposition and robust z-scores for contextual anomalies, and CUSUM change-point detection for sustained behavioural shifts like scope creep or a compromised agent. The deterministic rules run inline and never wait on a model; the statistical layer is advisory. In our own benchmark the deterministic detector out-scored a trained isolation forest.
- Per-agent baselines: STL decomposition and robust z-score
- Change-point detection (CUSUM) for scope creep and compromise
- PII, credential, and API key leakage detection
- Deterministic rules inline; ML stays advisory, never blocks the gate
Evidence packages. Not evidence scrambles.
The problem: Compliance for AI systems is manual, slow, and happens at the wrong time: retrospectively, under pressure, when auditors are already in the building. Teams spend weeks pulling together evidence that should have been collecting itself. The result is incomplete, and the stress is real.
How it works: BastionShield maps your decision receipts, access records, and risk events to SOC 2, ISO 27001:2022, GDPR Article 30, UK Cyber Essentials, and EU AI Act controls, continuously. When audit season arrives you generate an auditor-ready evidence pack in one click. This is supporting evidence for your audit, not a certification we issue. The rest of the time, a live dashboard shows which controls are healthy and which need attention.
- Auditor-ready evidence packs mapped to SOC 2, ISO 27001, GDPR, DORA
- Live control status: covered, partial, or a gap, with remediation
- GDPR Article 30 processing records for AI systems
- One-click export as JSON. Supporting evidence, not certification
Find the AI you never sanctioned.
The problem: Most organisations cannot say what AI they are actually running. Agents, API keys, and tools enter through vendors, integrations, experiments, and individual employees. A spreadsheet inventory is stale the day it is written, and every unregistered agent is an ungoverned attack surface you cannot see.
How it works: Bulwark surfaces unregistered and unsanctioned AI from egress, OAuth grants, expense, and DLP signals, risk-scores each finding with its suspected owner and data access, and lets you triage in one click: register it into governance, quarantine it, or dismiss it. An unknown becomes a managed inventory.
- Discovery from egress, OAuth grants, expense, and browser DLP
- Risk-scored findings with suspected owner and data access
- One-click register into governance, quarantine, or dismiss
- Turns shadow AI into an inventory you actually control
From zero to governed in four steps.
No infrastructure overhaul. No weeks of onboarding. You can have your first agent registered and logging today.
Register your agents
Call our registration API or use the dashboard. Each agent gets a signed identity. No infrastructure changes.
Define permission policies
Set what each agent can read, write, and call. Start broad, tighten over time. Policies are live immediately.
Logging starts automatically
From the moment an agent is registered, its activity is logged. No code changes in the agent required.
First evidence pack
After a month of data, generate an auditor-ready evidence pack mapped to your frameworks. Supporting evidence for your audit, in one click.
Six risks. All avoidable.
These aren't hypothetical. They're conversations we've had with CTOs who found out the hard way.
Agent reads customer data it has no business reading
HIGHAccess Control Layer restricts data scope per agent
Audit asks why your AI was allowed to act. You can't prove it.
CRITICALDecision Receipts record the why, on a tamper-evident chain
Agent is compromised via prompt injection
HIGHRisk Detection flags injection patterns in real time
Nobody knows what AI is running across the business
HIGHShadow AI Discovery surfaces unregistered agents and keys
Agent shares PII or API keys via output
CRITICALRisk Detection catches leakage before it leaves
Your governance vendor goes down and takes your agents with it
HIGHThe SDK caches signed policies locally, so agents keep deciding at the edge
Everything included. Free.
100k decisions / month · monitor mode, never blocks your agents
- Shadow-AI discovery
- Monitor mode + deterministic rules
- Human oversight (EU AI Act Art. 14)
- Self-verifiable evidence + SIEM export
- Unlimited agents
Ready to govern your agents?
We do a 30-minute architecture review. You show us your current agent setup, we show you exactly how Bulwark fits. No pitch deck.