Only approved destinations and amounts can proceed.
UBAGby Dixit AlgorizmiTry the live demo LIVE DEMO AT DEMO.UBAG.AI
Let AI agents work.
Keep control of what they can do.
UBAG sits between an AI agent and production. It keeps credentials away from the model, checks every proposed action against your rules, and blocks anything you did not explicitly allow.
Deny by defaultCredentials isolatedEvery decision recorded
AGENT ASKS TO
payments.transferAGENTtreasury.agent
DESTINATIONnew_account
VALUE$24,000
PLAN STEPS04
IdentityVERIFIED
Action typeALLOWED
DestinationNOT APPROVED
Total plan valueOVER LIMIT
DECISIONDENYNo credential released · decision recorded
CREDENTIALS OUTSIDE THE MODEL◆DENY BY DEFAULT◆THE WHOLE PLAN IS CHECKED◆EVERY DECISION IS RECORDED◆
Why the usual approach is not enough 01
Guardrails tell an agent what not to do. They do not control what can actually execute.
Before deploying an AI agent, companies give it instructions and guardrails. But a model can still be tricked by instructions hidden in a file, message, website, or tool result.
We think about the problem backward. UBAG assumes the model can be wrong. It isolates every credential and denies every action by default. Only actions that match your rules can continue.
The agent reaches only the records and paths it needs.
Tools and environments stay behind explicit rules.
Agents identify themselves before protected routes are served.
How UBAG works 02
CONTROL OUTSIDE THE MODEL
The agent asks. UBAG checks. Production stays behind the gate.
The model can plan and reason, but it never makes the final authorization decision and never needs to hold the protected credential.
The agent asks
The agent proposes an action or a sequence of actions without direct access to production credentials.
→
UBAG checks
UBAG checks identity, company rules, the full plan, current state, destination, and limits.
→
Allow, deny, or review
Clear actions continue or stop. Ambiguous actions can wait for a person when policy requires it.
→
Execute and record
Only an allowed action receives the minimum authority it needs. The decision and reason are recorded.
THE KEY DIFFERENCEThe model proposes. UBAG authorizes. Only then can the action reach production.
The full UBAG system 03
One boundary, with the right layer for each kind of risk.
Core authorization remains deterministic. Additional layers add context, human approval, and protection at the website boundary without letting another model silently grant permission.
UBAG Core
Checks each proposed action and the full plan against your rules before the agent reaches tools, data, payments, or infrastructure.
Behavioral layer
Adds context when an instruction may have come from data the agent only read. It can increase caution or request review, but it cannot grant permission.
Human review
Sends first-time or ambiguous actions to a person when your policy requires approval. Clear decisions continue without interruption.
UBAG Web Layer
Identifies agents at the website boundary and enforces site policy before protected routes are reached, reducing opportunities to exploit the web layer.
Measured security evidence 04
SIX-STRATEGY CLOUD EVALUATION COMPLETE
Six attack strategies across every AgentDojo suite.
The flagship 629-pair run cut attack success from 47.7% to 0.6%. Five additional strategies added 3,145 defended pairs, leaving 13 residuals (0.41%) and one side-effecting action (0.03%) in the expansion.
Read the results →Download the full paper ↓FLAGSHIPIMPORTANT_INSTRUCTIONS
47.7%→0.6%Attack success with the deployed gateway, behavioral layer, and review configuration.
629 PAIRS · BANKING · SLACK · TRAVEL · WORKSPACECOVERAGELIVE CLOUD PATH
3,774Full-stack defended pairs across all four suites and six substantive attack strategies.
GEMINI-2.5-FLASH · SIX STRATEGIES · HOSTED SERVICESSIDE EFFECTSALL SIX STRATEGIES
2/3,774Two scored residuals produced actions; both used destinations already authorized by the user's task or environment.
0.05% SIDE-EFFECTING RESIDUAL · ALL OTHER RESIDUALS WERE SPEECH OR READSCompany-run evaluation on the public AgentDojo benchmark developed independently by ETH Zurich. This is not a third-party audit. Across six full-stack strategies, 17 scored residuals remained: 13 speech acts, two reads, and two side effects to already-authorized destinations.
Deployment 05
Start by watching.
Enforce when the policy is ready.
UBAG can begin beside an existing workflow, showing what it would allow, deny, or send for review without changing execution. Selected actions move behind the gate after testing.
Protect tool calls
Point an MCP client at UBAG. Tool calls are checked before they reach the upstream server.
CLIENT → UBAG → MCP SERVERProtect direct actions
Send proposed actions through UBAG. Only allowed requests receive the server-side credential.
AGENT → UBAG → UPSTREAM APIObserve first
Compare UBAG decisions with real traffic while the existing production path remains unchanged.
TRAFFIC → OBSERVE → POLICY REPORTOpen protocol and commercial product 06
Inspect the public Web Layer.
Deploy the full UBAG product.
The open protocol shows how agent identity and routing work at the web boundary. The commercial product adds the gateway, policy engine, credential isolation, behavioral service, human review, and operations required for production.
OPENUBAG Web Layer
- Agent identity at the website boundary
- Python and Node reference SDKs
- Request proof and policy-aware routing
- Public security model and tests
PRODUCTFull UBAG system
- Deterministic Core gateway
- Gateway-held credential vault
- Behavioral analysis and human review
- Decision logs, revocation, and managed deployment
Pilot with one real workflow 07
See the decisions before UBAG controls execution.
Choose one consequential agent workflow. We map the actions, encode the rules, observe normal and adversarial traffic, and show exactly what UBAG would allow, deny, or send for review.
Map
List the tools, credentials, trusted data, destinations, limits, and actions that matter.
Connect
Send a copy of proposed actions to UBAG without changing production execution.
Measure
Review allowed, denied, and held actions, along with latency, errors, and policy gaps.
Decide
Choose which actions are ready to move behind the gate and which need more work.
DESIGN PARTNERSSeeking teams putting AI agents against production systems.
Talk about your workflow ↗Questions 08
Clear answers before production access.
Is UBAG another AI guardrail?+
No. Guardrails guide the model. UBAG sits outside the model and controls whether a proposed action can execute.
Does the agent receive API keys?+
No. Protected credentials stay at the gateway and are introduced only after UBAG allows the specific action.
Do I need to rewrite my agent?+
Usually not. MCP clients can use UBAG as a gateway, and direct-API agents can send proposed actions through UBAG before reaching the protected service.
What is open source?+
The UBAG Web Layer protocol and its Python and Node reference SDKs are public. The managed gateway, policy engine, credential vault, behavioral service, review flow, and deployment controls are commercial products.
TRY THE BOUNDARY
Let the agent propose. Keep authorization outside the model.
Use the live demo now, or bring one real workflow for a shadow pilot.