The EndLayer roadmap.
What the Guardian Agent Platform does today, and what is planned, area by area. Planned items carry no dates; ask us for the current timing.
Current release: Agent 3.7.2 and platform 3.21.0, released 19 October 2026.
Guardrails on prompts and tool calls
Sensitive data is checked on the device, before a prompt or a tool call reaches a provider. The matched text never leaves the machine.
- Available now31 built-in detectors, plus your own
Personal identifiers, secrets and API keys, UK, EU and US identifiers, and source code, plus up to 32 patterns you write. Anything that can be checked arithmetically is: a card number must pass Luhn, an IBAN mod-97. Each detector monitors, warns, redacts or blocks.
- Available nowCoding-agent hooks
Claude Code, Cursor and Codex CLI: the prompt and the agent's tool calls (shell commands, MCP calls, file reads) are checked before they reach a provider. Where a host cannot rewrite input, a match is refused instead of redacted.
- Available nowBrowser extension
Chrome, Edge, Brave, Vivaldi and Chromium: the text in an AI site's composer is checked, and rewritten or held, before it is sent. Safari, Arc and Firefox are not covered.
Agent behaviour
Rules for what an agent may do, not only what it may send. Each is set to Off, Warn or Block, and a rule you turn on starts at Warn.
- Available nowThe Guardian plugin
Placed by policy in Claude Code, Cursor, Codex CLI and Antigravity, with 13 controls, prompt injection and jailbreak among them, each with its own warn and block thresholds.
- Available nowComputer use and impersonation
Five rules: agents driving a browser, agents controlling the desktop, agentic browsers, agents sending email or chat as the person (Slack, Gmail, Outlook, Teams and Discord tools, and sendmail), and agents using the person's own accounts (git, gh, cloud CLIs, npm publish). Enforced through the agent hook in Claude Code, Codex and Cursor; matched by name.
- Available nowPermission modes
List the agent modes you accept. A configured default, or a session that actually ran outside the list, fails the check, so a bypass flag used once is caught.
- PlannedApproval before an agent acts
Hold an agent's action for a person to approve in the console, before it runs.
- PlannedIdentity and Conditional Access for agents
Give each agent an identity of its own, and apply access conditions to what it can reach.
Removal and kill switches
Taking software off a device waits for a person. Stopping a tool does not.
- Available nowApproval-gated removal
A blocked AI tool is uninstalled, and a blocked MCP server is removed from the tool's configuration, once an administrator approves. The approval stands, so a laptop that was offline is fixed when it returns.
- Available nowKill switches
Halt one tool, or the whole fleet: every prompt and tool call is refused, and the tool can be uninstalled.
- Available nowWebsite blocklist
Your MDM blocks the AI sites on your list, and the agent checks that the block is really in force.
- PlannedRemoving blocked skills
Blocked skills fail the device today; taking them off it is planned.
What the device reports
The inventory everything else is graded against, read from files already on the machine. The agent never runs what it finds.
- Available now21 signals, every 15 minutes
Twenty AI applications recognised by name out of the box, and a catalogue you can add to in the console. See the signals directory for each signal and what it leaves out.
- Available nowMCP risk tiers
Every MCP declaration gets a High, Medium, Low or Unknown tier from what it can reach: a shell, a credential that reaches off the machine or into a business system.
- Available nowSkills and commands
Listed per agent host, by name and origin; blocked skills fail the device. Scoring a skill's contents for risk is a separate choice an administrator switches on, because the text goes to a third-party provider.
- Available nowSoftware bill of materials per project
Each project profile has an SBOM, downloadable as CSV or PDF (platform 3.21.0).
Cost and seats
Usage is counted on the device and priced in the console, never on the machine.
- Available nowToken usage, priced
Usage records from Claude Code, Codex, Cursor and OpenCode, priced against a versioned rate table so history can be re-priced.
- Available nowBilled cost and idle seats
Connect an Anthropic or Cursor admin key to read the billed cost and flag seats nobody uses. Connecting a provider's billing needs an owner.
Microsoft
One consent to your tenant, and four Microsoft products become readable.
- Available nowIntune, Entra ID, Copilot and Defender
Intune coverage and its gap, rollouts with per-device results, Copilot adoption and Defender, through one connection.
- Available nowDirectory and leaver alerts
A bounded mirror of the Entra directory attributes each device to a person, and raises a leaver alert when an account is disabled but its machine is still reporting.
Cloud
Read-only discovery of the AI running in your cloud accounts, under the same policy.
- Available nowGoogle Cloud
A project's agents and its Vertex AI endpoints, mirrored once a day with six posture checks per agent. It can undeploy an endpoint or delete an agent.
- PlannedAmazon Web Services
Discovery of the AI services in your AWS accounts, such as Amazon Bedrock.
- PlannedMicrosoft Azure
Discovery of the AI services in your Azure subscriptions, such as Azure AI Foundry.
Applications
Bringing the AI inside your own products under the same policy and record.
- PlannedSDKs for Python, TypeScript, Rust and Go
Model calls, agent runs and tool calls from your own applications, with a decision point inside your services.
Policy and evidence
Every verdict keeps the policy version that produced it.
- Available nowFramework packages
Rules grouped for the EU AI Act (Article 4 AI literacy, Article 12 record-keeping, Article 14 human oversight, Article 26 deployer obligations), ISO/IEC 42001, the NIST AI RMF, SOC 2 and GDPR. A control the evidence does not reach shows as unevaluated. A package maps evidence to a framework; it does not certify you.
- Available nowEvidence packs and nightly export
An audit artefact for a period, and one NDJSON file a day to S3-compatible storage you own.
- PlannedRouting findings out
Sending findings to chat, ticketing, a SIEM or a warehouse. Today the record lives in the console, the evidence packs and the nightly export.
For what each signal reads, see the 21 signals; for how a rule becomes a decision, see Govern.
Give AI room to work.And clear boundaries.
See the Guardian Agent Platform on your own fleet. Find every AI tool, understand what it reaches and costs, and apply the controls your team needs.