AI agents

Your team gives the agent a ticket. It proposes a plan: phases, tasks and the files it will write. A person approves the plan before any write. Its file access goes through the same four states as a contractor's, so an agent scoped to src/web cannot read infra/.

• Writes outside the declared files are blocked and recorded.
• Gates check the work with your own type-check, tests and build, then confirm the app boots.
• A checkpoint per task, so any task can be undone on its own.
• A spending cap that stops the run, not a warning.
• Every prompt, tool call, output and verdict on the record.

A developer keeps their agent. The repository is not checked out on their machine. The agent points at Occlude's MCP server, and reading, listing, searching and running commands resolve through the same view.

The agent asks for infra/terraform/main.tf: no such file, and the attempt is logged. npm run build runs on the build's side against the whole repository, and the real output comes back. Security sees the files read, the attempts refused, the commands run and the diff.

If your company already routes agent tool calls through a central service, Occlude is one of the services it routes to. That service decides whether the agent may call Occlude. Occlude decides what the agent finds when it does.

If a poisoned config, pull request or ticket redirects an agent to look for secrets, the paths it is not scoped to are not there, and credentials are Absent. The attempt is the alert: it fires only on a real attempt at an Occluded or Absent path. The agent can still write bad code; that is what the gates are for.

An agent that sees less could do worse. We are measuring how much, on public tasks, at several levels of occlusion. We will publish the benchmark whole, including where agents fail.