Platform · Agent Shield
Your agents outlived the projects that created them
They write code, call tools and hold credentials. They were stood up for a sprint that ended months ago, by someone who has since changed teams. Nothing in your process says who owns them now, and nothing says who turns them off.
Agent Shield manages that whole life: discover every agent, give each one an owner and its own scoped credentials, enforce policy while it runs, and retire it with the keys revoked. Deployed in your own tenant.
The problem
Agent sprawl is the same story, with worse privileges
The AI sprawl argument applies to agents, only sharper: an unused copilot licence wastes money, while an unowned agent holds a key and takes actions.
Agents nobody owns
Built for a quarter-long project by someone who has since moved teams. Still scheduled, still calling tools, still answering to nothing. The person who could tell you whether it should be running does not work on it any more.
Credentials that never expire
An agent is usually given a long-lived API key, a service account, or a personal access token belonging to whoever built it. It outlives the project, the laptop, and sometimes the employee.
No inventory to audit
Agents are created in three different cloud consoles, a notebook, and a CI pipeline. There is no single list — which means there is no number to put in front of a board, a regulator, or an auditor.
No retirement step
Switching an agent off is a decision nobody is accountable for, so it does not happen. Shutting down the container is not the same as revoking what it could reach.
How it works
Five stages, from first sighting to revoked credentials
Each stage says which part of our stack does the work, so you can check the claim rather than take it.
Discover
Sweep the places agents are actually created — AWS Bedrock AgentCore, Azure AI Foundry and GCP registries — over MCP and A2A, and flag what comes back as registered, pending, shadow, or a data-residency risk. You start from a list rather than a guess.
Atlas AI · Agent Discovery (beta)
Register and own
Every agent resolves to a named accountable human, a business purpose, and a review date. Unowned agents are tracked as gaps instead of being left blank, so nothing quietly drops out of scope.
Atlas AI · Register and Owners
Give it an identity
An agent gets its own identity and short-lived, scoped credentials instead of inheriting its creator's. Scope is written down, so what the agent may reach is a reviewable decision rather than a side effect of who happened to build it.
Works with your existing identity provider
Enforce at runtime
For computer-use agents, every shell command, file operation and network call is validated before it executes — allowlists, dangerous-pattern blocking, credential scanning on write, and jailbreak and indirect-injection detection via Azure AI Content Safety, with Microsoft Purview DLP labels on file operations. Start in monitoring mode, which logs decisions without blocking, and switch to enforcing once you have reviewed what it would have stopped.
openclaw-promptshield · MIT, open source
Monitor, then retire
Health, risk score, success rate, 30-day cost and lifecycle stage for the whole fleet, with pause, quarantine and release next to each agent — and a retirement step that revokes credentials and keeps the audit trail rather than just stopping the process.
Atlas AI · Agents Control Panel (beta)
Where it runs
In your tenant, on your cloud, under your keys
A product whose job is to police agents should not require you to export every agent's activity to a vendor first.
Your own tenant
Deploy into infrastructure you already control, so agent telemetry, policy decisions and the audit trail stay inside your boundary. We do not need a copy to make the product work.
Azure, GCP, AWS or on-premises
The runtime enforcement layer is a Python package and a container, configured by environment variables — it runs wherever your agents run. The Azure path is the most trodden, because the content-safety and DLP services it calls are Azure services.
Open source where it is open source
The runtime shield layer is MIT-licensed and public, so your security team can read exactly which commands are blocked and why, and subclass a shield rather than fork the project. Atlas AI itself is a commercial platform.
An EU region, if you need one
For organisations that have to keep agent activity in the EU, the deployment target is yours to choose — including an EU region — because the deployment is yours.
The runtime shield layer is public at Prompt-Shields/openclaw-promptshield under the MIT licence. Read it before you trust it.
Proof
The agent screens, as they ship today
Discovery across three clouds, and a control panel where any agent can be paused, quarantined or released. Both views are marked beta inside the product.
Sweep AWS, Azure and GCP for every agent
A meta-agent queries Bedrock AgentCore, Azure AI Foundry and GCP Knowledge Catalog over MCP and A2A, then flags what came back as shadow, pending or a residency risk.
Screens are from Atlas AI, shown with the seeded demo dataset used in our walkthroughs. Agent Discovery and the Agents Control Panel are labelled beta in the product's own navigation; the identity, scoped-credential and retirement steps described above are delivered today with your identity provider and our engineers alongside your team.
Related
The rest of the agent story
Start with the list of agents you cannot name
Most organisations find more agents than they expected, and a handful holding credentials nobody meant to leave live. A demo starts with discovery against your own estate, not a slide.