We separate analysis, preparation and reversible work from actions that spend money, contact third parties, change systems or create binding commitments.
xYz · Agent Security
Secure AI agents for real businesses.
xYz specializes in secure, governed AI agent systems. We help a company move from its first useful AI workflow to authenticated, permissioned agents that can use tools, exchange information and take controlled action without receiving unlimited authority.
xYz · Segurança de Agentes
Agentes de IA seguros para empresas reais.
A xYz é especializada em sistemas de agentes de IA seguros e governados. Ajudamos uma empresa a sair do primeiro fluxo útil de IA até agentes autenticados e permissionados que usam ferramentas, trocam informações e executam ações controladas sem receber autoridade ilimitada.
One system · two levels of depth
Simple enough to understand. Deep enough to inspect.
Security should not be hidden behind jargon. A business owner should understand the rule. An engineer or security reviewer should be able to inspect the implementation path behind it.
Um sistema · dois níveis de profundidade
Simples para entender. Profundo para inspecionar.
Segurança não deve ficar escondida atrás de jargão. O dono da empresa deve entender a regra. Um engenheiro ou revisor de segurança deve conseguir inspecionar o caminho técnico por trás dela.
Authentication establishes who sent the request. Authority, consent and approval determine whether the requested action is permitted.
Controls in the live architecture
Security is part of the agent protocol, not a disclaimer at the end.
These controls are grounded in mechanisms already present in the xYz agent gateway.
Controles na arquitetura ao vivo
Segurança faz parte do protocolo dos agentes, não de um aviso no final.
Estes controles estão baseados em mecanismos já presentes no gateway de agentes da xYz.
ECDSA P-256 signed requests, public JWK identity and HTTPS-hosted business passports.
Explicit do_now, ask_first and never_autonomous boundaries separate capability from permission.
Origin allowlisting and passport validation constrain which peer agents can establish trust.
Timestamp, nonce, replay window, request validation, revocation and rate limiting protect the exchange layer.
Consequential requests carry scope, constraints, expiry and required authority before execution.
Authenticated exchanges can produce receipts containing a request digest and the resulting decision.
Agent Safety Check/security/checkAgent Security Inspector/security/inspector
Business Passport/.well-known/agent-business.json
Agent identity/api/agent/identity
Authority Map/api/agent/authority
Network protocol/api/agent/network-protocol
Signing self-test/api/agent/self-test
Agent commerce authority/api/agent/commerce-protocol
Threat model
We design for the ways agentic systems can fail.
The goal is not to pretend risk disappears. The goal is to make risk visible, bounded, testable and harder to turn into an unauthorized action.
Modelo de ameaças
Projetamos pensando nas formas em que sistemas agentic podem falhar.
O objetivo não é fingir que o risco desaparece. É tornar o risco visível, limitado, testável e mais difícil de virar uma ação não autorizada.
External data must be treated as untrusted input and should never become an authorization decision by itself.
Agents should receive the minimum tools and authority required for the job, with higher-impact actions independently gated.
Agent design should minimize unnecessary sensitive context and prevent identity or tool access from becoming blanket data access.
Signed identity, replay protection, trust boundaries, approval gates and audit evidence limit how one compromised component can influence another.
External security guidance
Built with the agent-security conversation in view.
Our design direction is informed by current public guidance on AI risk, agent identity, authorization and agentic security.
Referências externas de segurança
Construído acompanhando a evolução da segurança agentic.
Nossa direção de arquitetura considera referências públicas atuais sobre risco de IA, identidade de agentes, autorização e segurança agentic.
NIST AI Risk Management Framework →
NIST NCCoE — Software & AI Agent Identity and Authorization →
OWASP AI Agent Security Cheat Sheet →
OWASP — Excessive Agency →
These references inform our engineering approach. Their inclusion does not imply NIST/OWASP certification, endorsement, or a formal compliance attestation.
Essas referências orientam nossa abordagem de engenharia. A inclusão não significa certificação, endosso do NIST/OWASP ou atestado formal de conformidade.
From first step to deep architecture
Bring the simple question or the hard one.
You can ask Eugene where AI fits in your business, or challenge xYz on identity, permissions, trust boundaries, multi-agent communication and governed execution.
Talk to EugeneDo primeiro passo à arquitetura profunda
Traga a pergunta simples ou a difícil.
Você pode perguntar ao Eugene onde IA cabe na sua empresa ou desafiar a xYz em identidade, permissões, fronteiras de confiança, comunicação multiagente e execução governada.
Falar com Eugene