Credential protection
Credentials are encrypted with AES-256-GCM and can use AWS Secrets Manager as a backend.
Security
Autonomy with boundaries.
Control what agents can read, which actions they can take, when a person must approve, and what evidence every run leaves behind.
01 · Data boundary
Identity, policy, then execution.
Each request crosses explicit boundaries before an agent can read data or take an action.
User or service identity
An authenticated identity enters with an organization context and a defined role.
Organization and workspace policy
Resource permissions, guardrail policies, and approval rules determine what can proceed.
Customer-controlled deployment
The agent runtime reaches connected services only inside the deployment boundary you select.
02 · Control mechanisms
Controls are part of the run, not a wrapper around it.
Tenant boundaries
Organization-scoped access and PostgreSQL row-level security keep workspace data separated.
Role-based access
Owners, admins, members, viewers, and custom roles control access by resource and permission level.
Human approval
Approval nodes stop sensitive actions until an assigned reviewer approves, rejects, or lets the request expire.
Guardrail enforcement
Policies can inspect chat, agent tool calls, retrieved context, workflow nodes, and streaming output.
Audit evidence
Execution, user, policy, and tool activity is recorded for investigation and evidence export.
05 · The control plane
The control plane your CISO asked for.
Autonomy is only useful when you can govern it. Everything an agent does passes through policy — and leaves a sealed record.
Guardrails on every surface
11 guardrail providers — Llama Guard 3, Presidio PII, Bedrock Guardrails, OpenAI Moderation and more — enforcing on chat, tools, RAG and workflows, including mid-stream.
Humans stay in the loop
Approval nodes pause any workflow for sign-off. Agent write-backs to your knowledge graph route through a human review queue.
Permissions that mean it
Role-based access across 11 resource groups, org-scoped everything, and Postgres row-level security isolating every tenant.
An audit trail you can hand over
Hash-chained, Ed25519-signed, WORM-stored logs — exportable to Splunk, Datadog or Microsoft Sentinel in OCSF and CEF.
sample audit log
14:20:52 approval.requested → finance-review 15:01:08 approval.granted by=finance.reviewer 15:01:08 tool.executed database.insert 15:01:09 audit.sealed sha256:9c41…e2 ✓ 15:01:09 siem.exported splunk-hec · ocsf
Designed to map toEU AI Act · Art. 12ISO/IEC 42001NIST AI RMFOWASP Agentic Top 10
04 · Audit evidence
Reconstruct what happened without guesswork.
Every controlled run leaves evidence for operations, investigation, and review.
Sample evidence record
Execution history
See the workflow path, agent state, model usage, and outcome for each run.
Policy decisions
Record which guardrail or approval policy allowed, blocked, or escalated an action.
Tool activity
Inspect the connected tool, operation, timestamp, and result associated with an action.
05 · Framework mapping
Map control evidence to the frameworks your team uses.
Zilionix control evidence is designed to support mappings to the EU AI Act Article 12, ISO/IEC 42001, NIST AI RMF, and the OWASP LLM and Agentic Top 10. This is a control mapping, not a certification claim.
EU AI Act Article 12ISO/IEC 42001NIST AI RMFOWASP LLM Top 10OWASP Agentic Top 10
Security contact
Review a control or deployment question with our team.
Put boundaries around the work.
See how identity, policy, approval, and evidence fit into one governed run.