Hosted execution
Hosted coding enforces limits on protected file, network and credential operations as code runs. Workflows govern tool dispatch.
Sandboxes add defense in depth.
Zero Trust Actions.
Starting code does not grant it unlimited authority. Atellagent continues enforcing policy on protected operations during hosted execution.
Control as code runs.
Connected agents and MCP tools
Governed MCP connections support tool policies and response controls. Codex and Claude Code coverage depends on enabled hooks, delivered events, and the host honoring decisions. Unexposed events are not covered.
What we check.
In Enforce mode, policy determines whether an action or data release can proceed. An allowed action may still have data-sharing limits.
Permission in context
Evaluate who is acting, the target, current task state and evidence required by policy.
Semantic Review
A configured model reviews action risk using your criteria. Policy can deny a triggered external action or pause eligible hosted work. The model cannot grant permission or execute actions.
Data protection (DLP)
Check personal information, secrets and custom risks at configured releases to models, tools, channels and services.
Use built-in detectors or bring your own classifier. A configured customer classifier receives the content it checks. Policy considers the findings, identity, action and destination.
Decision records
Link the request and policy decision with available semantic assessment and observed outcome evidence. Missing native host outcomes remain explicitly unobserved.
Configure checks in Policies → Data Protection. Start in Observe, test representative content and destination rules, then enable Enforce on supported releases.
Detection and risk-review limits
Detectors can miss sensitive data or flag harmless content. A missing finding does not prove the data is safe to share. Prompt-injection checks on incoming model content are separate from data-loss prevention.
Built-in detectors check selected personal-data categories and known credential patterns. A customer classifier runs only at its bound, supported release point. Its scores feed policy; raw classifier responses are excluded from policy decision, cache, and telemetry records.
Risk review uses a bounded description of the exact action. Configured provider content controls apply; validated evidence informs policy. The reviewing model cannot override policy or change the action.
Authorized reviewers can inspect the criteria and findings recorded for the assessment, even after the organization's criteria change.
Protect MCP servers you operate.
Enterprise MCP places enforcement before tool execution at your server. Native authentication establishes the direct caller; central policy authorizes the exact action. Enabling direct clients opens an authorization path, and a failed required authorization stops execution.
Coverage depends on routing every protected tool dispatch through the installed handler. Other endpoints remain outside that boundary. Review Enterprise MCP
Check, enforce, record.
- Authenticate
Identify the participant and bind the request to its allowed scope.
- Check policy
Evaluate the requested action against current rules and required evidence.
- Allow or stop
Enforce applies the permitted scope at supported boundaries. A failed required, applicable check stops the governed operation.
- Record
Keep the decision and available outcome together.
Observe records potential outcomes without applying organization-authored restrictions; some checks run asynchronously. Mandatory platform protections still apply.
Free is Observe-only. Paid plans can enforce supported controls. View pricing
How it works.
See how policy, identity and evidence fit together.