Your stack watches the endpoint and the network. It doesn't watch what the agent does.
1.8.2: Enforce is available. Isolate is coming in a later release: its sealed workspace isn't ready yet.
An agent runs with your credentials, reads your files, and calls your tools, inside your trust boundary, where EDR, DLP, and identity see a normal session. Crawdad gives you the missing layer: runtime visibility into what each agent does, secret protection, a freeze when an agent goes out of bounds, and a verifiable record of every decision. On the device, before the action. Full enforcement comes with Enforce, which is opt-in.
Crawdad produces a runtime enforcement signal and evidence trail the rest of your stack can consume.
Protect agent tool use, prevent data loss, produce investigation evidence.
Your problem isn't detecting a known bad file. It's an agent, acting with real authority, steered by content it trusted, doing something it shouldn't, and you having no control point at the action and no record afterward. Crawdad is that control point.
Enforcement at the action, by identity
Bound each agent to its job (tools, data, effects) with a charter enforced on the observed action, on the wire. Out-of-scope is blocked, and the block names the axis.
Containment
On macOS, when agents run as a separate user, Enforce adds an OS-level default-deny egress lock (pf on macOS) that persists across a process kill; on Linux, and when agents run as you, Enforce works through Crawdad's own checks (the proxy, hooks and the secrets floor), and no network lock applies. Isolate, coming in a later release, will run the agent in a sealed VM. Crawdad freezes an agent that goes out of bounds today. Fail-closed by default.
Credentials made useless if stolen
The real key never enters the agent's environment; a leaked placeholder authenticates nowhere.
Evidence you can hand to an auditor
A signed, hash-chained log verifiable independently, no network, no vendor service, no secrets from the machine.
Proof you can run
A public, reproducible benchmark of real attacks, misses included.
What Crawdad covers, and what it doesn't
Crawdad governs the agent-action path. It doesn't replace your EDR/XDR/SIEM, DLP, IAM, secrets management, or sandboxing, it covers the layer they weren't built for, and produces a runtime enforcement signal and evidence trail the rest of your stack can consume.
See it on your own agents in a demo. Already a customer? Sign in.