Securitybelowthemodel,notinsideit.
An open runtime for enterprise AI agents. Any LLM, any framework. Enforcement at the kernel boundary.
Architecture beats policy. Prompt injection, indirect injection, scope-exceeding tool calls, and exfiltration via API all defeat guardrails that live inside the model. AgentStack puts the guard outside it. WASM sandboxing per tool. Ed25519 cryptographic action authorisation. Per-principal storage, capabilities, and budgets, enforced by the kernel. Semantic Intercept Fabric classification under 20ms. The same agent code runs unchanged.
WASM per tool
Sandbox
Ed25519
Auth
<20ms
Classification
None
Code change
Architecture.
USER SPACE
AGENTSTACK RUNTIME
HOST OS
Key features.
An open runtime for enterprise AI agents. Any LLM, any framework. Enforcement at the kernel boundary.
Architecture beats policy
Prompt injection, indirect injection, scope-exceeding tool calls, and exfiltration via API all defeat guardrails inside the model. AgentStack puts the guard outside it.
WASM sandboxing per tool
Every tool runs in an isolated WASM capsule. The kernel mediates every call.
Ed25519 action authorisation
Cryptographic authorisation on every action. Per-principal storage, capabilities, and budgets enforced by the kernel.
Semantic Intercept Fabric
Classification under 20ms. The same agent code runs unchanged — security lives below it.