Enforce01
Define the permitted scope.
Establish file access, network permissions, and resource limits before launch. Reject covered operations outside the installed policy.
Policy before execution
In development · product preview
The secure execution layer for AI agents.
Launch your agent in an isolated environment through one CLI. Set its permissions before it starts, enforce access boundaries as it runs, and trace activity across its child processes.
One CLI. Isolated execution. Policy in force.
01 / a controlled start
One CLI. A defined boundary.
Choose a policy and start a managed run. Bantay prepares the environment and establishes its permissions before the agent begins. The processes it starts stay within that boundary.
A MANAGED RUNILLUSTRATIVE PREVIEW
START WITH BANTAY
bantay run --policy bantay.toml -- <agent-command>Illustrative command · final interface may change.
- Environment preparedWorkspace isolated
- Policy activePermissions established
- Agent startedChildren inherit restrictions
RUN
run_7fa2
BANTAY ENVIRONMENTPolicy active
Code agentmanaged workload
Shellchild process
python3child process
Same run. Inherited restrictions.
Write workspace file
Succeeded/workspace/src/app.pyRead protected credential
Denied/protected/service-account.keyThe recorded event connects the denied read to the child process, its parent shell, and the managed run.
A sample managed run. Operations and outcomes shown here are simulated.
02 / during execution
Boundaries that carry through the run.
Permissions, activity, and process history belong to the same managed run. Three responsibilities, working together.
Observe02
See the activity that matters.
Inspect supported file activity, process execution, connection attempts, and decisions. Keep recorded outcomes and missing evidence visible.
Activity with context
Trace03
Follow the processes it starts.
Connect a recorded action to its process, parent, and run. Preserve that history as the agent starts shells and child processes.
A connected execution history
03 / explicit permissions
Give the task room to work.
Decide which resources the workload can access. The agent and its descendants run with those permissions, established before execution. A changed policy takes effect in a new run.
Read the thinking behind Bantay04 / connected evidence
Understand what happened. Follow the evidence.
Move from a recorded event to its process trace. Preview an AI companion that explains activity using linked evidence and helps identify what to investigate next.
bantay / consolePRODUCT PREVIEW
ACTIVITY / Code agent
One run. Connected events.
| Time | Process | Operation | Outcome |
|---|---|---|---|
| 14:08:01 | Code agent | Workload started | Started |
| 14:08:03 | python3 | Write /workspace/src/app.py | Succeeded |
| 14:08:04 | python3 | Read /protected/service-account.key | Denied |
SELECTED EVENT / evt_7f2b
Protected credential read denied.
The child process attempted a read outside the run’s granted file access. The recorded outcome is denied.
PROCESS TRACE / run_7fa2
Follow the action to its origin.
MANAGED RUNrun_7fa2Workspace policy
AGENTCode agentRoot process
CHILDShellStarted by agent
CHILDpython3Requested the read
Access denied
/protected/service-account.keyevt_7f2bThe child process remains within the managed run’s restrictions.
AI COMPANION / LINKED EVIDENCE
Ask about the activity.
INVESTIGATION CONTEXT
Protected credential readevt_7f2b- Process
- python3
- Result
- Denied
- Policy
- Workspace policy
A denial records a blocked action. It does not establish malicious intent.
BANTAY COMPANION
The requested file is outside the permitted scope.
python3 attempted to read a protected credential. The sample event records a denial. Its process trace connects the attempt to the shell and code agent in this run.
Review the event alongside the installed permissions to understand the access boundary.
Start with the process that requested access.
Open the source event, then follow python3 → Shell → Code agent in the trace. Review the task and workspace changes to understand why the credential was requested.
Check the evidence status before drawing a conclusion. Missing activity should remain an explicit gap.
Interactive product preview · synthetic events and illustrative AI responses.
05 / the details that matter
A clear scope.
What does the execution layer do?
Bantay prepares an isolated environment, installs the run’s permissions, and then launches the workload. It enforces policy on covered operations and records supported activity and process relationships.
Does the boundary include child processes?
Yes. Processes started within a managed run inherit its restrictions. The run’s scope includes those descendants, even if the original agent process exits first. Remote services an agent contacts have their own execution boundaries.
Can I attach to an agent that is already running?
The design distinguishes observation from enforcement. Attaching to an existing process provides observation with potentially partial history. An enforced run starts through Bantay, with the boundary established before execution.
What if part of the evidence is missing?
Missing evidence is reported explicitly. Recorded attempts, decisions, and outcomes remain distinct, and an unobserved result stays unknown. Policy enforcement does not depend on an event appearing in the console.
Is Bantay available today?
Bantay is in development. The CLI, console, and AI companion shown here illustrate the intended experience. Installation, supported environments, agent compatibility, and pricing will be published before access opens.
access / coming soon
A boundary for what comes next.
We’re building Bantay for controlled agent execution. Access and plans are taking shape; details will be available before launch.