Halo Security Platform
The control plane that produces your ATO.
Halo sits where AI agents act, decides what each agent may do, and enforces that decision before the action runs. Every allow and deny lands in a tamper-evident record an assessor can check offline, and the same record generates OSCAL authorization content.
Put AI agents to work without putting the authorization at risk.
AI agents call tools, write to memory, spend budget, and hand off work at machine speed, while the evidence for their authorization is still assembled by hand.
Agents that act within limits you can prove.
Every agent action is checked against policy before it runs. The decision is recorded in a form an assessor can verify without trusting the vendor, and it counts as evidence for the controls in your security plan.
An agent incident you cannot explain, and an ATO you cannot defend.
A hijacked prompt or a misused tool can do real damage, and logs anyone can edit do not show an Authorizing Official what happened. Halo blocks or escalates the risky action and keeps a tamper-evident trail behind each decision.
The rules for agentic AI are being written now.
OWASP published its Top 10 for Agentic Applications in December 2025, and FedRAMP 20x is moving authorization toward machine-readable OSCAL packages. Programs fielding agents today are assessed against these expectations.
Every decision produces its own proof.
Six stages share one audit path, so a firewall decision and a configuration change produce the same class of artifact.
Establish identity
People, services, and agents each get a distinct identity. Privileged operations require fresh re-authentication.
Register and govern
Agents, tools, prompts, and policies live in a catalog under a deny-by-default baseline. Modules are signed and checked before they install.
Intercept at the point of action
The agent SDK or the gateway sends each tool call and prompt through enforcement first. The answer is allow, sandbox, escalate, or deny, and a decision can only get stricter.
Detect and correlate
Analyzers look for ungrounded claims, deception, rogue behavior, and manipulation of human approvers. Signals link to incidents for timeline reconstruction.
Record
Every decision is appended to a per-tenant, tamper-evident ledger with signed checkpoints. Any edit to the history breaks verification.
Prove it anywhere
Ledger records link to controls and produce OSCAL SSP and POA&M content and signed export packs. A standalone verifier checks those packs inside a disconnected enclave.
Enforcement and evidence on one path.
Agents reach governed resources only after a recorded decision. Escalations go to a person, and every decision lands in the ledger that feeds the evidence.
Four decisions, each one on the record.
The tool firewall and the executive dashboard, from the Halo console.
What holds up when an assessor pulls the thread.
One path for enforcement and evidence
The decision that blocks a tool call becomes a signed ledger entry linked to a control. OSCAL content comes from that same data, so the security plan describes what the runtime did.
Verifiable without trusting the vendor
Modules, checkpoints, receipts, and export packs are signed by the platform. A standalone verifier rejects empty, forged, or tampered packs with no access to the running system.
Air-gap is a profile, not a port
Connected cloud, regulated cloud, on-premises, and air-gapped are configurations of one codebase. Signed transfer and license packs carry updates in, and licensing never calls home.
Built for the agentic threat model
All ten OWASP Top 10 for Agentic Applications risks are mapped to platform capabilities and SP 800-53 controls, each with a coverage rating. Runtime checks address prompt injection, tool misuse, memory poisoning, and delegation abuse.
Decisions only get stricter
Authorization is deny by default, and no policy can downgrade a firewall deny. Approvals and POA&M closure require different people, and the code enforces it.
Hardened where it counts
Browser script never sees a session token, and every query is filtered by tenant, with database-level isolation available. Container images are signed and ship with a software and AI bill of materials.
The combination is the point.
Halo puts runtime enforcement, a verifiable ledger, OSCAL evidence, and air-gap deployment in one platform. Established categories each cover part of that.
| Capability | Halo | SaaS agent guardrails | Cloud-native guardrails | GRC documentation tools |
|---|---|---|---|---|
| Inline enforcement of agent tool actions | Yes, through the SDK or gateway | Yes, a core strength | Partial, tied to the provider | No |
| Action ledger an assessor can verify offline | Yes | Rare | Provider logs | No |
| OSCAL SSP and POA&M from runtime data | Yes | Not typical | No | Documentation-centric |
| Air-gapped deployment | One codebase | Uncommon | No | Generally SaaS |
| Agent threat detection | Decision support for human review | Yes, a core strength | Yes | No |
Start on one boundary. Expand by need.
Most programs begin with one authorization boundary and the agents already running on it.
An audit trail for an ATO in progress
Ledger, evidence graph, and OSCAL output for one boundary, so agent actions reach the assessment as verifiable evidence.
Guardrails for a SOC copilot
Tool firewall, detection, and human approval around an assistant that can query and act on security tooling.
Runtime security in an enclave
The air-gapped runtime stack, with signed offline packs checked before import and no internet dependency.
Bought by ISSOs, AI security architects, platform owners, and SOC managers, usually after a 30-day proof of value on one boundary.
Halo ships as 25 signed modules on one shared services plane, grouped into six capability areas: core trust, runtime enforcement, detection and response, compliance and evidence, composite packs, and ecosystem and program. Programs buy them in four tiers.
Core
Identity, authorization, the ledger, evidence packs, and runtime enforcement for protected agents.
Regulated
Adds continuous ATO evidence, requirements as code, detection analyzers, and forensic replay.
Sovereign / Air-Gap
Adds offline operation: signed transfer and license packs, offline verification, and FIPS-capable images.
Program
Adds managed agent certification and the assessor field kit, delivered with services.
Mapped to the frameworks your assessor already uses.
Evidence links to the requirement it supports. Alignment is in direction and scope, not a certification.
This page is a public-safe overview. Interfaces, key handling, ledger construction, and detection logic are withheld and available under appropriate agreements.
See the trust chain end to end.
We walk a representative agent workflow from the firewall decision to the ledger entry and the control it supports. Then we export the evidence pack and verify it offline in front of you, along with a tampered pack that fails.