Docs / Agent Runtime / Control & Provenance

Control & Provenance

The layer a request-scoped proxy can't reach: CloudVera sees the agent's decision loop across a whole session, not one request at a time. A typed execution-provenance graph is the substrate; detection and enforcement are built on top.

Features

Execution Provenance

GET /api/ai-gateway/agents/:agentId/sessions/:sessionId/provenance returns a typed graph of the session — prompt, tool_call, retrieval, egress, and event nodes, linked by sequence / caused_by / evidence_for edges. It shows what the agent did, in order, which retrieval was evidence for which tool call, and where an injected instruction entered.

Lethal-Trifecta Detection

An agent is exploitable when one session combines all three legs — untrusted content ingested, private/sensitive data access, and an external egress path. Each is fine alone; the combination enables exfiltration. CloudVera flags the combination (a cross-tool-call correlation) and records a critical security event (→ violation) — surfaced in the Session Forensics view with per-leg evidence.

Inline MCP Proxy

Point an MCP client at POST /api/ai-gateway/mcp-proxy/:serverId (auth with a cvk_ or cva_ key). CloudVera screens each JSON-RPC message ON THE WIRE — blocking blocked, injection-flagged, or non-allowlisted servers (and, once a server's tools have been catalogued, tools outside that scanned set), and masking PII in tool arguments before egress — then forwards to the registered MCP server. True inline enforcement a non-SDK client can't bypass.

Agent Posture (AISPM)

GET /api/ai-gateway/agents/:agentId/posture scores how an agent is configured before it runs — tool policy, per-tool approval, intent-drift mode, session budget and step caps, the tenant egress allowlist, key expiry/staleness, and the review state of reachable MCP servers — as an A–F grade with a one-line fix per finding. GET /api/ai-gateway/agents/posture rolls the whole tenant up.

SIEM Export

Stream every security event and violation to Splunk, Datadog, Sentinel or any log pipeline as a normalized, ECS-flavoured record (event.outcome, event.severity, threat.technique.id for MITRE ATLAS, compliance.owasp_llm / nist_ai_rmf). Push: a webhook subscribed to security.event / violation.created / violation.status_changed with format splunk_hec or datadog — the secret is sent as the sink token. Pull: GET /api/siem/feed?since=&cursor=&dataset=&format= with a cv_ personal access token; GET /api/siem/schema documents every field with a sample.

Framework Mapping & Outcome

Every security event, violation, and provenance event node carries frameworkRefs — the OWASP LLM Top 10 (2025), MITRE ATLAS, and NIST AI RMF controls it evidences — and an outcome of prevented (blocked or redacted inline) or detected (observed, request went through). Both are computed on read, so historical events are covered; filter events with ?outcome=prevented|detected.

Coding-Agent Hooks (Claude Code, Cursor)

npm i -g @cloudvera/coding-agent-hooks, then cloudvera-hook install claude-code | cursor. Every tool call the coding agent makes (Bash, Read, WebFetch, MCP…) is recorded as a CloudVera tool call before it runs — tool allowlist, per-tool approval, intent drift and budgets apply, and a blocked call is denied in the editor. Credential-file reads (~/.ssh, ~/.aws, .env, keychain) and fetch/browse tools feed the lethal-trifecta detector, so an agent that read a secret and then reached the internet raises an incident. POST /agents/:id/sessions/external maps the agent's own session id onto one CloudVera session.

Auto-Triage (Guardian)

Every violation gets a verdict (confirmed / likely false positive / needs review), a P1–P4 priority, the evidence behind them and one-click actions — require approval for the tool, switch the agent to an allowlist, enforce intent, block the MCP server, kill the agent's sessions, mark false positive — computed by a deterministic engine over the event, the session provenance graph, the lethal-trifecta assessment, the agent's posture and the 30-day false-positive base rate; Claude writes the prose when a key is configured. A scheduled sweep assesses new violations within the hour; GET/POST /api/ai-security/violations/:id/triage and …/triage/apply.

Delegation-Chain Enforcement

For multi-agent calls, pass the who-delegated-to-whom chain (X-Delegation-Chain header or the SDK). CloudVera enforces a delegation-depth bound and holder-side scope attenuation — a sub-agent can't be handed authority its delegator didn't hold, and the invoked tool must be within the final delegated scope — which the transport-level OAuth/bearer auth can't see.