The agent execution boundary
Identity says who.
Warden says what happens next.
Every privileged action an AI agent takes on a machine is decided against policy, allowed or denied per call, and written to a signed record — while the agent keeps working.
Attaches to the agentic identity you already issue.
Recent decisions
3 agents| Agent | Verdict |
|---|---|
| claude-codespiffe:…/claude | Allowed |
| cursor-agentspiffe:…/cursor | Denied |
| copilot-agentspiffe:…/copilot | Denied |
Decision stream
signedBring your own agentic identity
We don't issue identity. We're where it lands.
Whichever provider you've chosen, the identity it issues becomes a first-class match criterion in Warden policy. SPIFFE works as-is — no translation layer, no new standard.
CrowdStrike
Agentic Identity Provider
Palo Alto
Idira
Okta
Okta for AI Agents
Microsoft
Entra Agent ID
Or your own SPIFFE trust domain, or local process attestation where no identity plane exists yet.
The gap
Zero standing privilege ends at the shell prompt.
Everything an identity provider brokers is a remote service. A local action asks none of them.
- 01
The agent is issued an identity
Cryptographically verifiable, never a standing credential. Your identity provider does this well.
- 02
Its access is scoped and revocable
Minimum access, minimum time, per task — and revoked the moment anything looks wrong.
- 03
And then it runs on a machine
A process, with a user id and a shell. Reading a credential file, spawning a shell, piping a download into it — none of that consults an authorization server.
→ identity: continuously evaluated
→ access: scoped, revocable
→ session: terminable in seconds
›read ~/.aws/credentials
›spawn /bin/sh
›curl … | sh
›systemctl stop <sensor>
How Warden works
Three things, at the moment the action happens.
Not a scanner, not a gateway, not a detection rule. A decision point between the agent and the machine.
Decide
Per call, not per session
Every privileged action is evaluated against a compiled policy before it runs. The identity your provider issued is a first-class match criterion — alongside the command, its arguments, the real binary behind the request, and the time of day.
Enforce
Deny the call, not the agent
A denied action returns an error to the agent and nothing else happens. The session carries on. Nobody kills a developer's work to stop one file read, which is why controls that can only terminate get switched off.
Record
One signed record per decision
Permits and denies both. Each record is hash-chained to the one before it and delivered off the box, so the log is verifiable later by someone who doesn't trust the machine it came from.
What it produces
One denied call, one signed record.
The agent kept running. The decision was signed and on its way off the machine before anything spawned.
agent claude-code pid 41882 identity spiffe://acme/agent/claude/ws-7f2a call openat("~/.aws/credentials") DENY rule 14 · credential-store-read EACCES before open completed record seq 1184 prev bd6f…a012 sig ed25519 ✓ off-box ✓ # the agent kept running.
✓Which agent
The attested identity your provider issued — not just a user id.
✓What it tried
The exact call, its arguments, and the rule that decided it.
✓That nobody edited it
Hash-chained and signed, delivered off the box, verifiable offline.
✓That permits count too
One record per decision, so the log is the whole behaviour — not just the blocks.
Assurance
It sits in the privileged path. It is built like it.
Warden decides whether privileged actions run, on every host you install it on. That is not a place for a wrapper script.
251
known ways to break sudo, collected over 27 years and checked against Warden's design — with a new one failing our build until someone has reviewed it.
Authority
Nothing carries standing privilege
There is no setuid binary on your system. One daemon makes the decision, and it is the only thing that can.
Policy
Sealed, and verified before it loads
Rules are compiled and checked on every load. If the file has been altered, Warden refuses to start rather than enforce the wrong policy.
Identity
Two agents, one user, different answers
The attested identity is part of the match — so the same account running two different agents does not get the same permissions.
Audit
Your log survives the host
Every decision is signed, chained to the one before it, and delivered off the machine — so the record holds even if the box does not.
What Warden does not do
It is tamper-evident, not tamper-proof. An attacker with root can disrupt the record. They cannot do it quietly, and you will know what was lost.
It does not inspect content you have allowed. If a channel is approved, what travels over it is your gateway's job, not Warden's.
It does not detect prompt injection. There is no pattern to match. Warden limits what the agent can reach instead.
Get started
Isolated runtime for agents.
The standard way to deploy AI agents — safely, anywhere.