Runtime governance: controls that adapt as agent behavior changes.
CompFly turns simulation findings into recommended runtime controls. Teams review the recommendations in plain English, tune the boundaries, and apply them before agents call models, tools, data, or other agents.
Where CompFly sits, on the request path.
CompFly sits inline with one line of code. The decision is made before anything reaches a model, a tool, another agent, or your data.
Any framework, instrumented with one line of code.
Every call decided before execution, against the controls designed for the agent.
Models · Tools · Agents (A2A) · Data
Controls composed per agent, recomputed per request.
Org-wide baseline controls and per-agent controls combine into one set of effective controls for each agent, evaluated in priority order on every call.
Org-wide baseline
Per-agent controls
Effective controls
The Autonomy Envelope: the exact set that will run, before you publish.
The Autonomy Envelope shows the combined set that will run on an agent, with each control’s source and action, before you publish. Nothing changes for a running agent until you publish to enforcement.
Every decision is recomputed on each call against who is calling, data sensitivity, destination, and how independently the agent is acting. The same agent gets tighter enforcement the moment the context turns risky, with no redeploy and no rule rewrite.
- baselineUnsanctioned model or tool calldeny
- baselineCredential detected in tool argumentsdeny
- per-agentEmail send to external domainapproval
- per-agentTool call outside approved behaviorwarn
Define controls in plain language.
Controls Assist is the AI assistant built into CompFly. It recommends runtime enforcement controls with full context: what Agent Simulation found when it attacked the agent, what the behavioral baseline shows the agent actually does, and where its risk tier sits.
Pick the ones you want, or describe the control you need in plain language and it drafts the definition and refines it with you. You review and approve before anything enforces. It works from your own agents and controls, so its answers reflect your environment, not a generic manual.
Don’t let this agent email anyone outside the company without a human sign-off.
Drafted a control:
email.send · external domain → require human approval
Review and approve before it enforces.
Stop chasing evidence for every AI agent.
CompFly continuously tests required controls, surfaces failures, and produces the evidence security teams, auditors, and regulators need.
Agent inventory, ownership and lifecycle status
Verifiable agent identity and credential lifecycle
Source grounding and anti-fabrication controls
Risk taxonomy, acceptance criteria and test governance
Adversarial threat taxonomy and red-team program
Cost, token, latency, compute and action telemetry
Every run compiles into a reproducible assurance report: runtime conformance, per-control pass rates with confidence intervals, a residual risk register, and framework mapping (AIUC-1, OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS, ISO/IEC 42001, SOX).
A per-agent definition of normal, human-approved.
Sanctioning decides what an agent may use. Behavioral control governs how the approved agent behaves once running. It judges what the agent does at run time, not what the model says it will do. Static guardrails catch what a human named in advance; the events that hurt are the ones no rule named.
Intended profile
Observed profile
Anomalies are deny-by-default, banded by risk.
The agent starts in a learning phase where nothing is ever blocked, so bringing an agent under behavioral governance never interrupts it mid-run. An administrator reviews each anomaly and either confirms it anomalous or marks it known with a justification (every review audited). Approving the baseline graduates the agent from Learning to Enforcing.
Only sanctioned models, tools, and MCP servers run.
Layered, broad to specific, so one decision at the right level covers everything beneath it.
Most specific match decides · covers everything beneath
Every agent carries its own cryptographic identity.
Every agent gets its own decentralized identifier (DID) and signing key, not a shared API key and not an IP address.
Authentication
Least privilege
Attribution
Non-repudiation
A person in the loop, only where it matters.
Human approvals for actions too consequential for an agent alone: handling sensitive transactions, deleting data, sending email outside the org.
Denied on the wire
A person approves with context
Scoped, expiring override
Approvals arrive where teams work, including Slack. Holding too much trains approvers to rubber-stamp, so approvals are reserved for what matters.
Last resort: kill switch
Secure, resilient, cost-aware access to every model.
Three modes of adoption, from advisory to fully managed. Start where your risk tolerance is today and move up without touching agent code.
Check
Passthrough
Gateway
set org-wide · override per agent · switch modes with no code change
Resilience and cost.
Failover chains
Key pools
Canary routing
Cost visibility
Providers
Watch the control plane deny an out-of-policy call.
A live session on your stack: an agent attempts an out-of-policy call and the control plane denies it before execution.