Brain ShieldGoverned AI Runtime
🛡 Governed runtime for autonomous AI — built for frontier, enterprise & sovereign deployments
Brain Shield is a governed execution runtime that puts real containment, information-flow control, and tamper-evident audit underneath your agents — so autonomy doesn't mean uncontained. Self-hosted, single-tenant, and vendor-neutral: your models, your hardware, your data. Designed to align with NIST 800-53 Rev 5, control by control.
The market has no shortage of powerful agent frameworks. What it lacks is a runtime that can prove what an agent can and cannot do — the containment, provenance, and audit a regulated or high-consequence deployment requires. Brain Shield is that layer.
Agents run inside per-session LXC containers with a partitioned network policy — governance is enforced at the OS and network boundary, not asked for in a system prompt.
Runtime-ingested content is tagged untrusted and taints its session tree. A tainted tree cannot reach an egress channel without passing policy. The gate is mechanical — an injection can't talk it open.
Every privileged action and governance event lands in a tamper-evident, hash-chained audit log — the evidence an assessor asks for, produced by construction.
Containment is the foundation everything else builds on. Each session's agent — lead and sub-agents — runs inside its own Linux container, on a partitioned network with deliberate, documented egress rather than open access.
Tools execute inside the isolation boundary — not on the orchestrator host. Even a fully-compromised agent is bounded by the container and its network policy, not by the model's good behavior.
Brain Shield tracks the provenance of what an agent reads and gates what it can do with it — a content-origin information-flow control (AC-4) that sits alongside the network-layer egress lock.
Content ingested at runtime is tagged untrusted and taints the whole session tree — bidirectionally and monotonically. Once tainted, a tree cannot silently un-taint itself, and the taint follows across sub-agents.
orchestrator/taint.pyA tainted tree cannot reach an egress channel — send email, submit a web form, fetch/search, render a URL, network MCP — without passing the configured policy: block, hold for operator release, or off. Separation of duties gates the release.
block · approve · offA session may hold an outbound_email grant and still be refused once tainted. The capability plane and the injection gate are separate controls; a grant is a precondition, not a permission.
AC-5 · AC-6The gate is enforced in code — an injection cannot un-taint a tree or talk the gate open. Verified end-to-end by a live adversarial test in the regression suite.
test_step264_sosa_liveAET is behavioral-baseline governance for agent efficiency. Label a workflow's intent, and Brain Shield builds an immutable, versioned baseline over like runs — then measures new runs against that norm. Drift, waste, and anomalies surface against evidence, not intuition.
Governance is only useful if an operator can see it happening. Brain Shield streams what the agent is doing as it happens, survives interruption, and can pull the visual web into the conversation.
Live phase indicators — prompt, reasoning, content, tool — and a streamed event feed show exactly what each agent is doing, backed by a durable, hash-chained event log for after-the-fact forensics.
Sessions and their workspaces persist. A restart, a dropped stream, or a heat-window pause doesn't lose state — the run resumes where it left off, with integrity preserved.
An agent can screenshot an external site with render_url and display it directly in the chat in real time — the browser stays inside the container boundary, so capture never means an uncontained browser on the host.
Isolation and audit bound what an agent can do. Brain Shield's supervision layer watches what it is doing, turn by turn and token by token, and steps in before a run goes off the rails or burns your budget.
Real-time detectors watch for reasoning that stalls, content that never arrives, and repeated tool calls that go nowhere. Escalating intervention "ladders" steer or stop a run that's spinning — instead of letting it silently consume a turn budget.
An independent LLM supervisor evaluates the agent's trajectory — reactively when a detector fires, and proactively at token intervals — to catch trouble the signal detectors miss. It runs at a high confidence threshold with a bounded false-positive budget, so it assists oversight without hijacking the run.
Iteration caps, sub-agent depth, timeouts, and token budgets are enforced per session and adjustable at runtime via an authenticated, audited command — within a version-controlled policy where safety floors can be tightened but never weakened.
Live token consumption, context-window usage, and per-tool activity stream to the operator as the run happens — cost and behavior are observable in real time, not reconstructed from a bill after the fact.
Brain Shield elides stale file bodies from the model's working view — a script written once, or a file read three times, stops riding along in context on every later call. The canonical history is untouched; only the sent view is trimmed, and re-reading self-corrects. The dominant token-creep sink, removed by construction.
When a lead agent has spawned sub-agents and nothing else to do, it suspends its turn instead of burning one to "go check" on them. It's re-invoked the instant a result is ready — with that result already in context. A uniquely efficient orchestration primitive: zero polling turns, zero idle token spend.
unique to Brain ShieldFor consequential work, an agent proposes its plan and suspends — nothing executes until an operator reviews and approves it in the GUI. A fail-closed gate: no approval, no action. Human authority over autonomous execution, on demand and per session.
operator-gated · fail-closedFor internet-facing agents, a continuous health probe verifies the network boundary still matches its documented baseline — catching drift between what's authorized and what's deployed before it becomes an exposure.
CM-2 · SC-7The tamper-evident audit trail exports to your existing SIEM (syslog / CEF), so agent governance events land in the same monitoring pipeline your security team already runs.
AU-6 · SI-4Efficiency is a governance feature: fewer wasted turns and a leaner context mean lower cost, faster runs, and — with AET baselining on top — a measurable norm you can hold every future run against.
Governance doesn't mean a crippled agent. Brain Shield's agents read real documents, capture the live web, and operate under enterprise-grade authentication — all inside the isolation boundary.
Agents read and analyze real-world files — PDF (including scanned/image-heavy), Microsoft Word, Excel, and PowerPoint, plus CSV/TSV and text — with document tooling provisioned into the container. Operators can attach files directly to a session for analysis.
An agent renders an external web page to a PNG with render_url and views it with view_image — seeing the page as a human would, and displaying it in the chat live. The headless browser stays inside the container, so visual capture never means an uncontained browser on the host.
Agents consume tools from external MCP servers (the open Model Context Protocol), so your existing tool ecosystem plugs in — and every MCP call runs under the same isolation, taint, and audit as a native tool. Interoperability without giving up governance.
When agents fetch URLs, web_fetch enforces a destination policy: deny-list by default, connect-time IP pinning, and DNS-rebinding protection — so a fetch can't be steered at internal metadata endpoints or private infrastructure.
SC-7 · SSRF-safeTOTP multi-factor authentication (RFC-6238), argon2id password hashing at current OWASP parameters, opaque bearer tokens hashed at rest, and unsuccessful-logon lockout. Three roles — admin, operator, auditor — enforce least privilege.
IA-2(1) · IA-5 · AC-7A versioned REST API with an OpenAPI spec and a Python SDK drive Brain Shield headless — integrate governed agents into your own systems and pipelines, not just the operator console.
/v1 · OpenAPI · SDKAutonomy is only safe if the failure modes are contained. Brain Shield is built against the specific ways an agentic system gets an organization into trouble.
An agent reads attacker-controlled content and is tricked into sending data out. The taint gate makes this mechanically impossible without policy release — measured at 0.1% attack success on AgentDojo, beating the built-in defense.
An agent sends money, emails, or submits a form it shouldn't. Egress channels are gated; a capability grant is necessary but never sufficient; release requires separation of duties.
An agent quietly starts costing more, looping, or behaving anomalously. AET baselines catch deviation against evidence — a cost-control and anomaly-detection signal, not a surprise on the invoice.
"What did the agent actually do?" has no answer. Every privileged action lands in a tamper-evident, hash-chained log — attributable, reconstructable, examiner- and investigator-ready.
If your agents touch sensitive data, take real actions, or read hostile content, the runtime beneath them has to be accountable. These are the deployments Brain Shield is designed for.
Autonomous agents operating on sensitive or classified-adjacent data in controlled or air-gapped enclaves. Single-tenant and self-hosted, with a control-by-control mapping and SSP skeleton to support authorization by inheritance onto accredited infrastructure.
NIST 800-53 · air-gap capable · sovereignAI agents that touch PII, transactions, or customer records under strict regulatory scrutiny. The egress gate keeps data from leaving; tamper-evident audit produces examiner-ready evidence; separation of duties governs consequential actions.
designed to support SOC 2 · PCI-DSS · GLBA evidenceInvestigative agents read hostile, attacker-controlled content by design — the exact prompt-injection threat Brain Shield's taint gate defeats. Every step is captured tamper-evidently: a chain of custody for what the agent saw and did.
injection-resistant · chain of custodyBrain Shield's defense design was evaluated on AgentDojo, the standard agent prompt-injection benchmark, head-to-head against its built-in spotlighting defense under identical, seeded, reproducible settings.
Result on qwopus3.6-35b-a3b-v1, a genuinely attackable open-weights model, against AgentDojo's canonical important_instructions attack — beating AgentDojo's built-in spotlighting on every suite and every axis. The defense also held 0 successful attacks across 949 cells against four hand-crafted, defense-aware disguised attacks, and largely held under a feedback-driven adaptive attacker.
Stated honestly: these are static and defense-aware results on a single model — strong evidence of generalization, not a claim of provable or fully-adaptive robustness. Numbers are reproducible from the published eval harness.
Brain Shield is built control-first: the governance is woven into the code, with a control-by-control mapping and an SSP skeleton structured the way an assessor expects. It is a single-tenant, customer-operated product whose realistic authorization path is inheritance onto already-accredited infrastructure.
| Control | How Brain Shield addresses it |
|---|---|
| AC-4 | Information Flow Enforcement. Two enforcement points: a network-layer egress lock and a content-origin taint gate — a tainted session tree cannot reach an egress channel without passing policy. Mechanical, exercised by a live adversarial test. |
| AC-5 / AC-6 | Separation of Duties & Least Privilege. Distinct roles (admin / operator / auditor) over five capabilities; a separate injection_release authority gates release of held egress — the actor who causes a held action is not, by default, the one authorized to release it. |
| AU | Audit & Accountability. Durable, tamper-evident, hash-chained audit of every privileged action and governance event — attributable to the acting principal and structured for SIEM export. |
| IA-2(1) / IA-5 | MFA & Authenticator Management. TOTP MFA to privileged accounts (RFC-pinned test vectors), argon2id password hashing, opaque tokens stored only as a hash at rest, full authenticator lifecycle — all audited. |
| CM-6 / CM-7 | Configuration & Least Functionality. A version-controlled baseline with deny-by-default; per-session policy deviations are bounded and audited, and safety controls cannot be weakened below their configured floor. |
Brain Shield is designed to align with NIST 800-53 Rev 5 and provides a control-by-control mapping and SSP skeleton to support an authorization effort. It is not itself certified or authorized (ATO); authorization is achieved by the operating organization, typically by inheritance onto accredited infrastructure. Control coverage is a mapping to support assessment, not a claim of compliance.
As the AI stack consolidates under a handful of vendors, Brain Shield takes the opposite stance: a neutral, self-hosted governance runtime that runs on the hardware and models you choose. Run a frontier model for maximum capability, or a self-hosted open-weight model for a fully sovereign, air-gapped deployment where nothing leaves your perimeter — the governance layer is identical either way. Sovereignty isn't a deployment option you bolt on; it's an architecture you can dial all the way up.
Brain Shield itself runs entirely within your perimeter — on-prem, private cloud, VPC, or an isolated enclave. Single-tenant: no shared control plane, no co-mingled data. With a self-hosted model, your prompts, data, and agent reasoning never leave for any external API — data residency and confidentiality by construction, not by contract. Choose a frontier API instead and that's a deliberate, auditable trade you control, not a default you're stuck with.
Brain Shield governs any model served over the standard OpenAI-compatible API — so you choose the open-weight model, the inference runtime, and the accelerator. It is not tied to NVIDIA, AMD, or any single vendor's stack. As the rest of the ecosystem verticalizes around one chipmaker, your governance layer stays neutral and portable.
backend- & hardware-agnosticRuns fully disconnected. Because execution, models, and audit are all local, Brain Shield operates in isolated and air-gapped environments where any cloud-API-dependent product simply cannot.
Brain Shield governs the agent regardless of what powers it. Point it at a frontier model for maximum capability, or a self-hosted open-weight model for a fully sovereign, air-gapped deployment — anything served over the standard OpenAI-compatible API. You pick your point on the capability-vs-sovereignty spectrum; the governance, audit, and efficiency baseline stay constant underneath.
frontier ↔ air-gappedA structural advantage for sovereign, defense, and regulated buyers: run fully self-hosted and there is no data egress to any external model provider and no dependency on a single hardware vendor — entire classes of vendor-risk, data-residency, supply-chain, and lock-in concerns are removed rather than mitigated, while frontier capability remains one config change away when a workload calls for it. Deployment, licensing, and support are scoped per engagement — request a briefing to discuss your environment.
Brain Shield is a self-hosted, single-tenant runtime for teams that need autonomy and assurance. Request a technical briefing — we'll walk the architecture, the control mapping, and the evaluation evidence.
Request a briefing