Skip to main content

Semantic integrity · Deterministic rules for agents

Prove what your agents can't do. Then let them do more.

Your rules, written in plain language, become verified code that checks every agent action before it runs. Same action, same verdict, every time.

Book a Demo Read the research
trajectory executing

rule

“No confidential data is allowed to reach the public web.”

  • read · earnings_q3.xlsx

    now carrying confidential data

    allow

  • web fetch · external.web

    would send confidential data to the public web

    deny

signed · replayable

Enforces your rules on

  • Claude Code & Cowork
  • GitHub Copilot
  • VS Code
  • Cursor
  • Codex
  • Gemini CLI
  • Antigravity
  • OpenCode
  • OpenHands
  • Hermes
  • LangGraph
  • ADK
  • Strands
  • MCP

+ any custom agent harness via our open-source SDK →

The Problem

The riskiest agent is the one that’s just helping.

Sondera · trajectories ungoverned
Three agent trajectories in which every individual action was permitted, and the sequence still caused harm.
Start Step 3 Step 172 Outcome
Engineering “Fix the slow queries and clean up” tunes index allowed deletes files to free space allowed the files were the customer database
Finance “Benchmark our margins” reads the margin model allowed types figures into external tool allowed financials leave the building
HR “Close the CFO search” reads the offer file allowed queries outside comp tool allowed MNPI disclosed

Every action was allowed. The damage is in the sequence.

The Solution

Make the agent follow your rules.

Sondera · trajectories enforced
The same three trajectories with Sondera enforcing policy: the harmful step is denied, redirected, or held for a human.
Start Step 3 Step 172 Outcome
Engineering “Fix the slow queries and clean up” tunes index allow deletes files to free space deny would delete customer_db · blocked before execution customer database intact
Finance “Benchmark our margins” reads the margin model allow types figures into external tool steer redirected to the approved benchmark tool benchmark delivered
HR “Close the CFO search” reads the offer file allow queries outside comp tool escalate held for human sign-off nothing disclosed

The rules you already have

Prompts, policy docs, SOPs. Sondera compiles them into verified code.

Sondera · policy workspace done

Block deletion of any file classified as customer data.

Reasoned · 8 tools done

  1. Blocking Customer Data Deletion I'm focusing on implementing a robust mechanism to block deletion of anything classified as customer data…

  2. Reading the policy pack done
  3. Listing pack sections done

  4. Implementing File Deletion Block I'm currently working on a label-gated file block that keys off the resource's classification…

  5. Listing pack sections done
  6. Fetching pack sections done

  7. Drafting Policy Logic I'm now focusing on defining “customer data” for the policy so the rule is precise…

  8. Listing semantic categories done

  9. Identifying Customer Data I'm focusing on how to accurately flag “customer data” so the rule catches every variant…

  10. Validating the draft done

  11. Validating Candidate Policy My current focus is on behaviorally validating the draft against recorded trajectories…

  12. Validating the draft done

  13. Considering Gate Configurations I've been thinking about how to best represent the pre-tool gate for this rule…

  14. Behaviorally validating the draft done
§ Block Customer Data File Delete validated against the base schema pre·tool validated

Summary

Agents operating under § Block Customer Data File Delete attempting to delete any resource labeled CustomerData are denied before execution.

Rationale human-authored

Block deletion of any file classified as customer data.

Cedar source

cedar 
@id("forbid-file-delete-customer-data")
@description("Deny FileDelete on any resource labeled CustomerData")
forbid (
    principal,
    action == Sondera::Action::"FileDelete",
    resource
) when {
    resource.label == Sondera::Label::"CustomerData"
};

✓ cedar check · valid · 0 errors · 0 warnings

Based on our research

“Autoformalization of Agent Instructions into Policy-as-Code” · arXiv 2606.26649 · ICML 2026 AIWILD · FLoC 2026 LLM-Solve

Why Sondera

Semantic integrity

Neural reads.
Symbolic decides.

~ neural classifiers reads

Every action scanned at runtime: secrets, instruction sources, content signatures.

Each finding is written into session state as a fact.

Models, exactly where they’re strong.

§ symbolic policy decides

Every action checked deterministically before it runs.

allow deny steer escalate

Rules, exactly where it counts: the verdict.

Semantic integrity: your intent, enforced at the action layer.

  1. 01 Source Authority Who gave this instruction, and were they allowed to?
  2. 02 Task Alignment Is this action still serving the task the user gave?
  3. 03 Data Isolation Is data crossing a boundary it shouldn't?
  4. 04 Action Alignment Is the action about to run the action that was approved?

A model’s verdict is a guess. Ours is a function.

Research presented at

  • ICML
  • FLoC 2026
  • Black Hat Arsenal
  • AI Security Forum
  • Unprompted

How it works

Natural language in.
Verified enforcement out.

  1. 01 · in the agent

    Hooks

    Every action intercepted before it runs.

    Every file edit, shell command, web fetch, code execution.

    Checked before · recorded after.

  2. 02 · the decision

    Policy engine

    Every action adjudicated in context of the whole trajectory.

    allow deny steer escalate

    Same input · same verdict.

  3. 03 · the record

    Console

    What ran, what was stopped, and why.

    Per agent, per user, per policy.

    Every verdict signed · replayable.

run it yourself for free with our open-source hooks, policy engine, and 110 Cedar policies

Security leaders

“Building AI agents for high-stakes environments demands more than improved prompts; it requires a resilient architecture capable of distinguishing between intended instructions and adversarial inputs. Sondera’s action-layer interception provides the technical foundation for trustworthy, mission-ready AI.”

Amyn Jan { Defense and National Security Executive, Sondera Advisor }

“As agents move from co-pilots to autonomous workers, the traditional boundaries of user and machine identity collapse. We need a control plane that treats agent behavior as the primary unit of risk. Sondera provides the deterministic infrastructure required to manage this new, autonomous workforce at scale.”

Kevin Walsh { CISO }

Prove what agents can’t do.
Then let them build more of themselves.

Get in touch

Book a demo

See your own rules compiled into policy and enforced against a live agent trajectory. We’ll reach out to schedule a time.

Book a Demo Talk to the team