humming arms
Menu
Book a demo

Know what they did.
Stop what they shouldn’t.

An agent decides. A tool uses a credential. A real system changes. Humming Arms records and controls that action path, outside the agent.

Book a demo
An agent action travels through a tool and the Humming Arms boundary to credentials and a real system. Each packet is stamped and recorded; one denied packet is diverted to containment.Agent decidesCalls a toolCredential / APIReal systemRECORD → VERIFYDENY → CONTAINHumming ArmsDENIEDThe action path runs down the left. A Humming Arms node sends a record to verification on the upper right and diverts a denied action to containment on the lower right.Agent decidesCalls a toolCredential / APIReal systemRECORD → VERIFYDENY → CONTAINHumming ArmsDENIED
Record the action. Control the boundary.

Independent action evidence.
A separate circuit breaker.

Find your path

Same action.
Two urgent questions.

Why both paths?

Start with the question your team needs to answer. The record and the stop belong together: a denied action needs evidence, and a stop needs an observed result.

One action branches to a verifiable record or a containment response; selecting a question highlights that route
Choose your solution path

AI agent audit trails

Connect identity, action, target, policy decision and observed outcome. Humming Arms preserves signed, linked records so a reviewer can check the exported sequence against trusted keys and checkpoints.

Use this path when a responder asks what was accessed, or a reviewer asks whether the record changed. Start with the identity and target, follow the policy decision, and compare the observed outcome with the original request. Export the sequence with the trust references needed for review.

Open the audit trail case file

AI agent containment

Pause a run, kill a controlled process, revoke credentials or cut egress according to policy. Humming Arms keeps the breaker separate from the agent and connects the requested stop to its observed effect.

Use this path when the next action is unsafe. Each control reaches a different surface. Check cached tokens, child processes, established sessions and direct routes; escalate any stop whose effect remains unresolved.

Explore the containment timeline

Explore both paths. Choose a question to follow its route.

Example flows, not measured stop times; capture coverage and stop authority define the boundaries.

AI agent monitoring,
where actions happen.

  1. ModelProposes the next step
  2. Agent runtimeCoordinates the run
  3. Humming ArmsRecord · check · enforceAction layer
  4. ToolsInvoke an operation
  5. Credentials / APIsGrant access to a target
  6. SystemsReceive the effect
Follow an action through the stack: a model proposes it, the runtime selects a tool, and credentials authorize its effect on a system.

Outside the agent.
Across the action path.

Action-layer monitoring observes the tools, network, files and credentials through which an agent affects other systems. A model’s account of its work is useful context; the action boundary supplies the observation to inspect.

Humming Arms is independent of the model’s reasoning. Signing keys and breaker authority stay outside the agent sandbox. Deterministic policy evaluates protected actions locally, without a network or model call on the enforcement hot path.

What this means for your stack

Map the runtime’s tools, outbound routes, file access, process execution and credentials. The same action-layer questions apply across frameworks: who acted, which resource was targeted, what policy decided and what the system did. Recheck the inventory whenever a runtime, worker or credential changes.

Keep execution traces for debugging, evaluations for task quality and action evidence for review. These approaches answer different questions and can sit alongside one another. Explore the Humming Arms action layer.

The important boundary is where an agent gains the ability to change something.

Coverage follows deployed sensors and the stop authority available at each boundary.

AI agent risk management:
give each risk a control.

What the controls prove

Start with the action that can cause harm. Pair a preventive boundary with the record needed to investigate it. Record captures the operation; verify checks its integrity; deny blocks a protected action; contain interrupts further access at the controlled boundary.

A policy decision, a stop acknowledgment and an observed outcome are separate facts. Keep all of them.

Agent risks, control responses and inspection priorities
Risk on the action pathControl responseWhat to inspectWhy it matters
Destructive actions
denycontain
Test children and queued work.

Restrict writes and execution at a controlled boundary. Check child processes and queued work after a stop.

Recovery must address changes already made.

Data exfiltration
recorddenycontain
Check every outbound route.

Record the destination and policy decision. Test DNS, direct connections and established sessions alongside tool routes.

An overlooked route can carry data beyond the controlled boundary.

Runaway loops / cost
recordcontain
Inspect repetition and in-flight requests.

Connect repeated actions to an identity and run. Check queued and in-flight requests after pausing or killing.

Accepted remote requests may continue after the local run stops.

Credential misuse
denycontain
Test access after revocation.

Limit task authority and preserve attempted use. Test cached tokens, sessions and child identities after revocation.

Usable credentials can outlive the process that first used them.

Unverifiable logs
recordverify
Check integrity and capture gaps.

Check signed records and sequence links against trusted keys and checkpoints. Inspect sensor outages and capture gaps.

Integrity and capture coverage answer different questions.

Compliance questions
recordverify
Agree on evidence and retention.

Connect identity, authority, decision and outcome. Agree on evidence fields, redaction, retention and export.

Evidence gives reviewers a basis for assessing the control.

Controls apply at instrumented boundaries; completed changes and compliance assessments require their own review. Review the security boundaries.

AI agent governance
is a shared responsibility.

Governance connects authority, evidence and a response owner. Different teams use the same action record to answer different questions; agree on the boundary before the run starts.

Platform / infrastructure

Where can this run reach?

Map tools, routes, credentials and workers across the fleet. Identify sensor coverage and breaker authority at each boundary. Bring the same coverage map to deployment changes and incident review, so ownership survives a runtime change.

Security

What stops the next action?

Connect risky operations to deterministic policy and scoped containment. Test allowed and denied paths, then verify the stop’s effect. Keep unresolved access visible and assign escalation to a responder who can reach the affected boundary.

Compliance / GRC

Can someone else check it?

Define the action fields and trust references an independent reviewer needs. Inspect export, capture coverage, redaction and retention together. Preserve verification materials and a repeatable process for checking the exported sequence.

AI engineering

What actually crossed the boundary?

Keep traces for debugging and evaluations for task quality. Relate them to recorded tool actions and policy outcomes. A denied attempt belongs in the timeline even when the operation never reaches the external system.

How to control AI agents
in production.

Review one action from intent to effect. Use an allowed request, a denied request and a failed stop to test the whole response. Start with the requesting identity, follow the tool and credential, and finish at the affected system. Keep the request, policy reason and boundary observation connected, so the same walkthrough serves engineering, security and review.

  1. Map authority before intent.

    List the tools, files, outbound routes, credentials and workers available to the run. Identify the person responsible for each boundary. Follow one tool request through authentication to the affected system, including any direct path that bypasses the expected runtime. Include child processes, delegated identities, cached credentials and established sessions in the inventory.

    Ask for: A coverage map naming observed paths, unobserved paths and the authority available to stop each one.

  2. Define the permitted action.

    Specify the identity, operation and resource a policy allows. Decide which actions must be denied before they reach the target and which conditions require containment. Define the response to policy loss, stale policy and sensor or breaker health failures before enabling controls. Use a concrete resource and operation, such as a file write or outbound request.

    Ask for: An allowed example and a denied example with the matching policy reason preserved in the action record.

  3. Observe the stop’s effect.

    Request the scoped response: pause, kill, credential revocation or an egress cut. Separate receipt from effect. Check the process, remaining credential access or affected traffic; test in-flight requests, children and restart behavior. Escalate a rejected or unverified stop and assign the next response. Inspect queued work and requests already accepted by a remote service. Timestamp each boundary observation so the reviewer can compare receipt with effect.

    Ask for: The request, acknowledgment, boundary observation and any unresolved result in the same review.

  4. Give the reviewer the record.

    Export the sequence with trusted keys, checkpoints and other verification materials. Have a reviewer inspect an edited record, a missing middle record and a truncated export. Audit capture outages and redaction separately from cryptographic integrity, and preserve evidence before retention expires. Check exported identities, targets and outcomes against the incident timeline.

    Ask for: A reproducible verification result with its trust assumptions, coverage limits and retention scope.

Containment stops further access; recovery of completed effects needs a separate procedure.

Compare plan scope and retention →

AI agent security
questions.

What are AI agent security solutions?

They are controls for the actions an agent can take and the evidence those actions leave. Humming Arms pairs an independent flight recorder with a separate circuit breaker at instrumented action boundaries. Evaluate tool, network, file, process and credential coverage as part of the deployment review.

How does AI agent monitoring differ from tracing?

Tracing connects execution steps for debugging, including tool inputs, outputs and spans. Action-layer monitoring examines the operations that affect systems, their identities, policy decisions and observed outcomes. Verifiable action evidence adds signed records, sequence links and reproducible integrity checks. Keep traces and evidence for the different questions they answer.

Do we need audit trails or containment?

Use audit trails when you need to reconstruct and check what happened. Use containment when further access must stop. Most production reviews need both: a denied attempt still needs a record, and a containment request needs its acknowledgment and observed effect preserved.

Does Humming Arms work across agent frameworks?

Humming Arms observes and enforces at the action layer, outside the agent’s reasoning. The approach applies across frameworks through their action boundaries. Inventory tools, direct network routes, credentials and workers whenever the runtime or deployment changes.

Can a kill switch reverse an action?

Stopping and recovery are separate jobs. Containment interrupts further actions within its controlled boundaries. Recovery handles completed writes, sent messages and remote requests already accepted. Preserve the record and inspect the affected system to decide what recovery requires.

Does action evidence require full prompt capture?

No. Action evidence follows the operation, identity, policy decision and outcome. Humming Arms minimizes data and applies redaction or tokenization at sensors; payload capture and HTTPS decryption are opt-in per policy. Agree on the fields needed for investigation, keep tenant access scoped and review capture coverage alongside integrity.

Bring an action.
Follow it all the way.

Map what can happen, what gets recorded and what can stop. Walk through the evidence and containment boundaries with Humming Arms.

Book a demo