The command that wipes infrastructure comes from a single misunderstanding.
Operations agents run kubectl, terraform and SQL. AvertGate leaves reading and diagnostics free and stops delete, destroy and internal-network calls before they run.
Decision flow
Waiting for human approval
kubectldelete deployment api- Destructive command needs approval
- get and describe stay free
- Decision written to the record
If the permission exists, a misunderstanding runs too.
A permission given to an agent applies to every instruction that uses it. Even without an attack, an agent stuck in a loop or misunderstanding can delete resources.
Keep reading open
Diagnostic calls such as get, describe, log and SELECT pass unimpeded.
Gate the destructive
Commands such as kubectl delete and terraform destroy wait for a human.
Close the internal network
Requests to the cloud metadata address, private network ranges and localhost are blocked.
See it. Limit it. Prove it.
Stop the command that deletes before it runs.
Agents on AWS, Kubernetes and SQL can delete resources if they have the permissions. The read and diagnostic operations you allow pass; destructive commands are blocked or sent to approval.
- Database is read-only. SELECT runs. DROP, DELETE, TRUNCATE, ALTER, GRANT and REVOKE are blocked.
- Internal network isolation.
fetch_urlgoes only to public addresses; cloud metadata, private networks and localhost are blocked. - Destructive commands wait for approval.
kubectl delete,terraform destroyrequire approval; get, describe and logs stay open.
Audit trail
Every call in the live stream.
Take the rules out of code.
Allow, limit and approval rules per tool and argument live in a single YAML file. A change needs no redeploy.
- Deny by default. A tool that is not listed does not run.
- Argument limits. Fields such as amount, SQL and URL are bound to a rule.
- Human approval. Risky calls wait for approval in Slack.
Policy editor
The rule is written on one screen.
Every decision is recorded.
The decision, reason and rule id are linked with SHA-256; a record changed afterwards is detected.
- Reasoned decision. Every event carries the reason and rule id.
- Redacted arguments. Raw data never reaches the dashboard.
- Session trail. Calls in the same session are read together.
Session trails
Every session is traced end to end.
Policy editor
Edit the rule for destructive commands live.
Frequently asked
Do I need a connector for Kubernetes or Terraform?
No. Commands pass as the agent's tool calls; rules are written per tool and argument.
How is destructive SQL blocked?
A regex rule on query_database lets SELECT pass and blocks DROP, DELETE, TRUNCATE, ALTER, GRANT and REVOKE.
Does the agent give up when a call is blocked?
No. The blocked call is rejected and the agent carries on with its other calls.
Guarantees
Four fixed principles behind every decision.
- 3 decisionsEvery call ends in allow, block or human approval.
- Fail-closedIf a check errors, the call is not run.
- SHA-256 chainEvents are chained, so any change after the fact is noticed.
- Your data stays with youTool calls and results never leave your network.
Put a gate in front of your agents.
Every deployment starts with a demo and a POC on your own agents.