SECURITY
Zorro is an execution governance layer for AI agents. It does not scan content and report a score. It decides, at the moment an agent acts, whether the source that caused the action had the authority to cause it, and signs the answer.
Causality inside a transformer is not observable from outside it, so Zorro never asks which context item caused an action. It asks a decidable question: is this action’s parameter a member of a finite, human-authored set?
THE QUESTION
A denial and every allow emit evidence with real provenance. An unlogged allow is an unauditable allow.
THE PROPERTY
Untrusted content attenuates the session the moment it arrives, not when a model reads it. Encoding, obfuscation and paraphrasing change nothing, because the attenuation already happened. Nothing in the context can raise authority back; only a human grant can.
THE TEST
Capability in grant · not expired · pins intact · parameters within origins. No scanning, no matching, no model. O(grants × parameters), both small. p50 latency in microseconds, p99 in milliseconds.
CAPABILITIES
ModifyAgentConfig is the meta-capability: writes to the agent’s own control surface. It is always-human and can never be inside a grant. CVE-2025-53773, CVE-2025-59536 and CVE-2026-48124 are all this capability.
Said plainly so an unqualified soundness claim does not die in diligence.
The real-time decision happens only at the edge. The cloud is never on the path of a tool call; if it is down, enforcement continues.
Decides every tool call across five harnesses, with p50 latency in microseconds and no network on the hot path.
Sees the subprocesses a hook cannot, like the postinstall that opens a socket, and attributes them to the agent session. Linux only today; the macOS and Windows collectors report UNAVAILABLE rather than guessing.
Pins every tool definition before it is forwarded, closing tool poisoning and grant rug-pulls.
Keeps raw secrets out of the agent’s environment behind ephemeral, scoped tokens.
Seals each session into a DSSE / in-toto attestation: agent, model, MCP inventory, findings. Unobserved fields read UNAVAILABLE.
Attack-path graph, detectors that may only lower authority, and remediation that a person approves.
The full accounting. Unmeasured is UNAVAILABLE, never zero. The two largest entries are structural rather than statistical: nothing is ingested agentlessly at the front of the loop, and execution has exactly one effector at the back. See the loop, link by link ↗
MEASURED
NOT MEASURED / NOT CONNECTED
This is our dated review of the competitive landscape, sourced in the strategy documents. “Lacks X” is a positioning hypothesis, not a categorical claim; the incumbents do their jobs well.
Identity & data graph, agentless
Veza, Cyera
IdP, drives and SaaS metadata · after the fact
Their breadth of agentless enterprise ingestion is real, and we do not have it today. What it does not do is decide inside the agent loop. Mapping who holds what is not the same as deciding, at the moment an agent acts, whether the source that caused the action had the authority to cause it.
Detection over agent telemetry
Uber ADR, Norton AI Agent Protection
transcripts, hook logs, rules · after, or on a score
Detection is close to solved; blocking before the action is not. ADR reports 67% detection at zero false positives on ADR-Bench, after the fact.
Registry & supply-chain gates
JFrog, Snyk
what enters the machine · before install, not in the loop
A registry gate sees the package, not the injected instruction that later makes the agent run the wrong command.
Server-side sandboxes
Kosmoy Action Capsule, Cisco DefenseClaw
containment of a running agent · beside the agent
Isolation is real and valuable. It runs beside the agent, not inside its loop, and it has no instruction provenance or signed record of the loop itself.
THE MARKET IS CONSOLIDATING ON THE LAYER
Incumbents spent the year buying the runtime and containment point: Palo Alto (Protect AI, ~$634.5M secondary; Koi, $231M primary), Cisco (Robust Intelligence; Astrix, ~$400M secondary), Check Point (Lakera), Proofpoint (Acuvity), SentinelOne (Prompt, $250M primary). The market map itself names three gaps no vendor has filled.
THREE GAPS, ATTRIBUTED TO THE MARKET MAP (2026-04-05, SECONDARY)
Derived, not learned. “Normal” is decidable from the committed HEAD: lockfiles, remotes, scripts. Anything outside the derived origin sets asks. No training data, no score to tune.
A byproduct, not a product. One identifier spans identity → MCP pins → hook and kernel → signed policy → attestation, because the enforcement point is the observation point.
The primitive is built. Inter-agent Ed25519 verification exists as a library (not yet wired into the live hook path) and the MCP proxy pins every tool definition. The same primitive extends to an agent-to-agent protocol.
Sources and access dates are in the strategy’s market evidence file. This page states positioning, not measured rates.
EVIDENCE AT THE CORE
Ask us for the command that produced any number above. If a number isn’t here, it hasn’t been measured.
Talk about a pilot ↗