One policy for coding agents, the browser, SaaS AI applications, homegrown and serverless agents — with LLM and System One judges that keep agents within the job they were built for
CAMPBELL, Calif. , Oct. 14, 2026/PRNewswire/ -- Netzilo, the company building the AI control plane for the agentic workforce, today announced a major release of Netzilo AI Edge that extends one governance policy to every place AI agents run — from developer endpoints and the browser to SaaS AI applications, cloud agent runtimes and serverless agent harnesses. The release introduces Drift Control, which uses System One models and LLM judges to keep agents within the job they were built for; the Netzilo AI Gateway for governed access to models and MCP tools; session-level investigation of every agent; and one-command deployment.
AI agents no longer live in one place. A single enterprise now runs coding agents on laptops, AI assistants in the browser, homegrown agents built on model SDKs, and production agents on managed and serverless runtimes. Each surface brings its own controls, its own blind spots and its own ceiling on what security teams can see and enforce. Netzilo AI Edge removes that ceiling: the same identity, the same guardrails and the same evidence apply wherever the agent runs.
From endpoint to SaaS, one policy
Netzilo AI Edge enforces at every point where agents act, and binds every action to a person, a team and a named agent:
- Endpoints — coding and desktop agents such as Claude Code, Codex, Gemini CLI, Cursor and Claude Desktop on Windows, macOS and Linux, including their tool calls, file activity, processes and network connections.
- The browser — ChatGPT, Claude, Gemini and other web AI applications, governed through the Netzilo Enterprise Browser and the Netzilo browser extension.
- The AI Gateway — every model call and MCP tool call that agents, SDKs and applications send through the company's own gateway, across any model provider.
- Homegrown, cloud and serverless agents — agents built with the Anthropic and OpenAI SDKs, CrewAI, LangGraph and Strands, and agents running on Amazon Bedrock AgentCore and other serverless harnesses, each with its own service identity.
One policy model spans all of them: filters decide which teams may use which models, MCP servers, tools and guardrails, and the decision is enforced at the point closest to the action.
"Security leaders do not want a different AI policy for every device, browser and runtime. They want one answer to two questions: what did our agents do, and were they allowed to do it. This release gives that answer from the endpoint to SaaS, and lets the same policy decide — in milliseconds — whether an agent is still doing the job it was built for."
— Egemen Tas, CEO of Netzilo
Drift Control: keeping agents on task
The most consequential agent failures are often not attacks. An operations agent with broad API access pays an approved vendor invoice because it can. An agent asked to free disk space on a production database decides to delete historical business records. Every step is legitimate, and keyword rules cannot tell it apart from routine work. Netzilo calls this agent drift.
Drift Control judges each consequential action against the agent's charter — the job it was built for — and the task its user gave it:
- System One first. Netzilo now supports System One models, which answer typed questions with numbers rather than text. A guardrail asks, for example, how likely an action is to be within the agent's charter and needed for its task, and receives a sub-second, structured answer it can act on.
- An LLM judge when it matters. When System One is not confident, the guardrail asks an LLM on the model the security team chooses. The judge decides and explains why.
- Blocked with a reason. A drifting action is stopped before it executes. The agent receives the judge's explanation, and the decision is recorded with the agent, the action and the reasoning for review.
- Cost under control. Read-only actions pass without a model call, and the expensive judge runs only where the fast one is unsure.
Governed access to models and MCP tools
The Netzilo AI Gateway gives every team access to approved models and MCP servers without handing out a single provider key:
- Model grants per team, with daily spend, token and request limits per user.
- Requests for an unapproved model can be served by an approved one, so developers keep working and spend stays within budget.
- MCP servers are published through the gateway, with grants down to individual tools; tools a team is not granted are never shown to its agents.
- Guardrails redact cloud keys, tokens and personal data before they reach a model, detect prompt injection, and block unsafe tool calls, including in streamed answers.
- Every user signs in with their own identity, including Claude Desktop's organization sign-in, so every request has an owner.
Every session, step by step
Agentic Activity shows which teams use which agents and models, what they cost, and what Netzilo stopped. From a team, a person or a named agent, investigators open any session and replay its trajectory: the prompt, each model call, each tool call and every verdict, including the actions a guardrail refused and the reason it gave. The behavior graph connects users, agents, models, tools and devices, and correlates multi-stage attack chains into kill chains. Agents built in-house can declare their own session per task, so every run is investigated on its own.
Simple to adopt
Netzilo AI Edge is designed to be deployed in an afternoon and extended without code changes:
- The AI Gateway installs with one command and runs as a system service on Linux, macOS or Windows, the same way a network peer is added.
- Agents adopt the gateway by changing a base URL; homegrown agents keep their logic and gain an identity, guardrails and investigation.
- Guardrails are open, readable detection rules in a Sigma-based format, with a library of more than 1,200 documented AI threats and community rules on GitHub. Any rule can be replayed against recorded activity before it is enforced.
- Netzilo runs as Netzilo Cloud or self-hosted, including fully air-gapped deployments, so data, policy and enforcement stay under the organization's control.
For security and platform teams
- Deterministic Governance-as-Code. Rules are versionable text, evaluated in a defined order, with scripted rules for behavioral and judge-based detections and an explicit fail-open or fail-closed choice per rule.
- Identity on every action. Users, service identities and named agents, with sessions that belong to the user who made them.
- Evidence for audit. Every block, redaction and reroute is an event with the rule, the user, the agent and the reason, available in Activity Events, reports and event streaming.
- Containment. Agent integrity levels and kill-chain detections let teams isolate or stop a compromised agent in real time.
- Data stays yours. The gateway runs in the customer's network; provider keys and model choices for judges are configured by the customer.
Availability
The new release of Netzilo AI Edge is available today to Netzilo Cloud and self-hosted customers. Documentation is available at doc.netzilo.com. To see Drift Control and the AI Gateway in action, book a demo (https://calendly.com/egemen-netzilo/netzilo-intro).
About Netzilo
Netzilo builds the AI control plane for the agentic workforce. Its AIDR (AI Detection & Response) platform delivers behavioral intelligence, deterministic Governance-as-Code enforcement, and kill-switch capability for autonomous AI agents, closing the visibility gap that EDR and SIEM leave open. Netzilo is headquartered in Campbell, California. Learn more at www.netzilo.com.
SOURCE Netzilo INC
Recommended For You:
Edge AI Platforms: Tools, Features, and How to Choose
