.svg)
.svg)
Use case · Runtime Control for AI Agent Workloads
Control AI agents running in your clusters
AI agents can read files, call services and execute code inside your infrastructure. Raven identifies the library paths behind those actions and prevents covered operations that violate runtime policy, before they execute.
/ 02 — SCENARIOS
An agent's decision becomes a server action.
SCENARIO A
A reporting task attempts a process launch
An agent processes reports. Its document-processing path attempts to start a shell without process-execution permission. Raven prevents the covered launch.
SCENARIO B
A document tool attempts network access
An agent invokes a document tool. Its library path attempts an outbound connection despite having no network permission. Raven prevents the covered connection.
/ 03 — MECHANISM
Put runtime permissions behind agent actions.
1
See the code performing the action
Identify the library chain performing a sensitive operation inside the agent application.
2
Define permitted capabilities
Set file, network and process-execution permissions for the relevant library paths.
3
Prevent the unauthorized operation
Deny the covered operation before execution. Retain its library path, workload and policy outcome for investigation.
/ 04 — EVIDENCE
See an agent action meet its runtime policy.
Inspect a prevented operation from an agent workload. See the library path that attempted it, the enforcing policy and the cluster context. Give your team a concrete record of what was prevented.
3
2
1
1
Which code attempted it
The library chain behind the process-launch attempt.
2
Which action was prevented
The attempted operation, recorded denial and matching policy.
3
Where it ran
Cluster and workload context associated with the same event.
Control actions where your agents run.
Apply runtime controls inside supported clusters and server workloads.
Constrain sensitive capabilities at the code path performing the action.
Give security teams library and workload evidence for investigation.
/ 06 — FAQ
Questions before you deploy
Which agents does this cover?
Agents whose application code runs inside your supported, instrumented clusters or server workloads. Enforcement applies to covered actions where that code executes, even when the application uses an external model API.
Is this prompt filtering?
Raven controls runtime actions inside the agent application. Prompt guardrails address model input and output; Raven enforces permissions on the code performing the resulting operations.
What can we investigate after prevention?
The attempted operation, responsible library chain, affected workload and enforcement outcome. This helps your team understand which code attempted the action and which runtime policy prevented it.
Let agents work. Keep their runtime capabilities under control.
See how Raven prevents an unauthorized operation inside an agent workload and provides the code context behind the decision.
