AI AGENT GOVERNANCE · ON-DEVICE
Your policy allows, refuses or escalates every agent call to files, keys, shell and network, logged and tamper-evident.
DEMO DEVICE · SYNTHETIC DATA
A risky action waits with the rule that caught it named. Someone releases it with a reason and Touch ID, or security decides for the team.
Every decision is logged on the device with its session and process chain, ready to replay.
Approved configs are fingerprinted. A change is flagged by file and time at the next scan.
The problem
No company sets out to give AI agents unrestricted access to its systems. It happens one reasonable decision at a time, and teams rarely see when those permissions add up to more access than intended.
Each approval is sensible on its own. By the fortieth, "allow for this session" becomes "always allow", and nobody looks at it again.
Cleaning it up doesn't hold. New grants arrive as you work, and nothing flags the one that widens what an agent can do. The file records what was allowed, never when or why.
A rule blocking sqlite3 means little when the same list lets an agent run any Python it writes. Python opens the database just as easily.
38 "deny": [ 39 "Bash(sqlite3 *)" 40 ], 41 "allow": [ 42 "Bash(python3 -c *)" 43 ]
How control works
Four steps, in order. Mockingbyrd proposes; you decide at every one.
01 · MEASURE
Doctrine Scan checks every agent it can see from disk against the rule pack, weighted by severity, with evidence for each check.
You decide: which findings matter.
02 · IMPLEMENT
Every fixable finding comes with a script you can read first. Nothing runs until you approve it.
You decide: which scripts run.
03 · ENFORCE
Guard reads the command that will run and applies your policy before it executes. Block, allow once, or allow for N minutes.
You decide: the calls policy does not cover.
04 · WATCH
Drift Watch fingerprints settings.json, the guard hook and CLAUDE.md, and keeps 60 scans of history.
You decide: accept the change or roll it back.
Sessions, subagents, scheduled jobs, connectors — the roster names which kind each one is rather than flattening them, and fills a cell only from something on disk: a permission entry, a profile, an agent definition, a scheduled job, a connector declaration.
The combinations that matter are named underneath each one: reads widely and can send off the machine, runs arbitrary code, runs unattended while nobody is watching.
The eight are files, shell, code runners, network, delete, secrets, originals and connectors, ordered by consequence — what each column means is on the Agent Roster page.
Connectors enabled in the web app are configured server-side, so a locally declared list is a floor, not the whole picture. The roster says that on the screen rather than in a footnote.
DEMO MACHINE · SYNTHETIC AGENTS
What you get
Controls are weighted by what they cost you when they fail, so the number moves for reasons you can name. Every check shows its working.
No silent remediation. The change is written to disk as a script you can open, before anything runs it.
A command that reaches for an original stops before it runs, not after — and you are asked, with the command in front of you.
It takes effect on the next call and resumes itself. The log keeps running throughout, so a paused window is visible afterwards rather than a gap.
Fingerprints on the files that matter. A control that quietly stopped holding is an event, not something you discover in a quarterly review.
Ships with one rule pack. Every rule is a shell probe you can edit, weight, disable or replace — write your own and the score follows.
Token use and API-equivalent spend by model, by project, by week — read from the session logs your agents already write. Producing it sends nothing anywhere.
It scores the waste too: whether caching is working, connectors that sit unused while adding their description to every prompt, agents spending unwatched, and sessions picked up cold when a fresh one would have been cheaper.
It is not a bill. Consumer Claude and ChatGPT subscriptions are not billed per token — this is what the same traffic would have cost at list prices, which is a sense of proportion rather than an invoice.
DEMO MACHINE · SYNTHETIC SESSIONS
Paste your Claude Code settings.json to see your score. Your file stays in your browser and is never uploaded. The page blocks network connections and shows you how to verify this in your browser’s Network tab.
The engine
See what your agents can access, set boundaries for their work, and keep a record of what happens.
Approved configs are fingerprinted. A change is named by file and time at the next scan.
Learn more →Agents work on copies. Deletions are never delegated, and a backup is confirmed before anything changes.
Learn more →What the agents cost, by person, model and week, rebuilt from session logs already on the disk.
Learn more →What an agent may reach in one session, and which combinations need a second pair of eyes.
Learn more →Holds a risky command below the permission list. Claude Code today; Codex, Cursor and Gemini CLI next, including their skip-permission modes.
Learn more →Nine waste detectors, and caps per session, per day and per unattended run.
Learn more →One rule set pushed to every machine, approvals that round-trip to a person, and drift raised as an event rather than found later.
Learn more →Enforcement at the operating system rather than on hooks. Opens when Apple grants the Endpoint Security entitlement.
Learn more →Signed audit export, SSO, SCIM and SIEM export, with a SOC 2 report behind them. Opens with the first team whose review asks for it.
Learn more →Billed on measured, incremental savings against a baseline you can audit. Opens only once the savings test clears on real bills.
Learn more →Who it is for
One rule set across the agents your developers already run, in week one.
For security →Held, not blocked. The rule that caught it is named, and you release it yourself.
For developers →What the agents cost by person, model and week, and which spend bought nothing.
For finance →One doctrine across the fleet, and evidence when a control stops holding.
For teams →Agents running over mail, documents and portfolio data, with no security team behind them.
Read more →Questions before you install
Including where the controls stop.
Nothing it measures. Scans, the guard and the token ledger read files already on disk, and no scan result and no file content is ever sent anywhere. Five things can leave, and each is yours to switch on or off: an update check at launch, which fetches one static file and carries no identifier; a price-list update you trigger yourself; crash reporting, which is off until you turn it on and then sends a stack trace with no identifier for you or your machine; activation past the trial, which sends an email address and the machine code shown in Settings; and Agent Access, which is off until you link an account — after that its calls reach Google, Microsoft, Notion or Slack as you, and the sign-in is held in your Keychain. What the ledger reads, it does not keep: a repeated read is spotted by hashing the result in memory and keeping the hash, never the content.
Claude Code and Codex in full: their permission lists, their session logs and the tool calls the guard inspects. The roster goes wider — it reads the connector lists of Claude Desktop, Cursor, Windsurf, Continue, Zed and VS Code, and it reads code signatures and macOS grants for any app on the device, so an assistant it cannot read a config for still appears with what the system allowed it. The token ledger and the usage detectors cover Claude Code and Codex only.
Apple silicon machines running macOS 14 or later. The app is signed and notarized, and it runs without a sign-in. The trial runs seven days; past it the app needs an activation code, which means giving us an email address and the machine code shown in Settings — the only identifier we collect.
A deny rule sitting beside a wildcard interpreter grant stops an honest agent, not a prompt-injected one. If Bash(python3 -c *) is allowed, Python can do whatever the deny rule forbids. Mockingbyrd flags that grant as a finding, with the file and the line, and the guard reads the text of every command below the permission list — so an original named plainly in the Python version is still caught. It does not follow the interpreter, so the fix is to scope the grant.
A block asks first: Block, Allow once, or Allow for a set number of minutes. Every answer is logged, so you can review later what went through.
Only after you approve it. Every fix is written as a shell script you can read before anything runs it — including the one-click fixes, which show you the script first — and your settings are backed up before any change.
It runs as you, so an agent with a general interpreter can reach it — this app included. That is not isolation and we do not claim it is. What the controls buy is that switching it off takes more independent steps and that every one of them is visible: the configuration is fingerprinted, so you get a drift alert naming the file and the time it changed. If you want a boundary rather than a reduction in expected loss, the next step is a separate user account or a virtual machine, and everything here makes that move cheaper rather than harder.
No. It prices the same traffic at API list rates, which is the right number for comparing two ways of working and the wrong one for reconciling an invoice — consumer Claude and ChatGPT subscriptions are not billed per token at all. The Token Ledger section has the rest.
Pilot
Install, scan and review the first findings together. Policy stays on each device, and what we learn with you decides what gets built next.