AI agents now take real actions—refunds, emails, deploys. Existing tools secure WHO an agent is (OAuth/identity); none answer whether an authorized agent is being manipulated right now. Lelu is the behavioral layer that authorizes every tool call before it runs—catching prompt injection and low-confidence actions. Confidence comes from the model's logprobs, not a number the agent can fake. Four outcomes: allow, deny, human-review, or a safe alternative. Open source & self-hosted.
