We're launching AxioRank tomorrow (the security gateway for AI agents), and before

we do I'm curious how this community is handling it today.

• If you have agents calling tools, APIs, or databases: are they on static keys or

  short-lived identity?
  Do you enforce a policy on what they can do, or mostly log it

  after the fact?
  And could you prove to an auditor what an agent was allowed to do?

  Genuinely want to hear what's working and what isn't.

Most AI security tools inspect prompts and flag bad content. Useful, but the agent

still authenticates with a static key and a log you have to trust.

Our take: security has to be enforced at the chokepoint, before the action reaches

your systems, with an identity per agent and an audit you can verify.
We're launching AxioRank tomorrow on this thesis. Curious whether you agree or push back.

While building AxioRank we kept hitting the same gap: no agreed way to prove an AI agent's action stayed inside policy.

So we wrote one, AGS-1, with a verifier anyone can run offline. Launch is tomorrow. Happy to answer anything about the spec or why we went open.