Plain definitions of the concepts Crawdad implements to secure AI agents, each grounded in the runtime proxy rather than marketing. Runtime enforcement runs on macOS and Linux; Windows provides monitoring today. Protection is scoped to agents whose traffic is routed through Crawdad.
also: govern an AI agent by purpose
Contextual agency governance is deciding whether an AI agent's action is permitted by the agent's assigned purpose, rather than only whether the content is a known attack.
In Crawdad an operator declares a per-agent charter, and the local proxy evaluates the actual tool call the model returned against that charter, blocking anything outside it on-device, at the wire. Because the decision is about the agent and its action rather than the bytes, the same request can be allowed for one agent and blocked for another. Detection asks whether content is an attack; governance asks whether the action fits the agent's job, and Crawdad keeps the two as separate mechanisms.
Contextual and trajectory governance exist in other tools. What Crawdad combines is on-device enforcement, a full authoring and review surface, and fleet rollup in one platform.
An agent charter is an operator-declared allowlist of the tools an agent may call, the data (paths, hosts, recipients) it may touch, and the effects it may produce: read, write, external-send, execute, delete.
Crawdad holds the charter outside the agent's control and enforces it on the observed action, so a deceptive stated intent buys nothing. An out-of-charter action is blocked and the block names the axis that fired: capability, target, or effect. Charters are opt-in per agent and fold into the same on-device decision as the rest of the governance plane, taking the most restrictive outcome.
also: the agent never holds the secret · transport-layer credential injection
Credential mediation lets an agent make authenticated API calls without ever holding the API key.
Crawdad keeps provider credentials in a broker at the local proxy. The agent sends its request with a placeholder; after the request passes policy, Crawdad injects the real secret into the outbound call at the transport layer, so the key rides the wire but is never returned into the agent's context. A prompt-injected or compromised agent has no key to exfiltrate. The broker covers Anthropic, OpenAI, and Google, including the URL-key and OAuth forms, and is proven bypass-impossible end-to-end in tests.
Trajectory detection scores the shape of a whole agent session, not just single requests, to catch a staged compromise whose individual steps each look allowed: enumerate a directory, read progressively more sensitive in-scope files, then send.
Crawdad keeps a bounded per-session window of action features, scores escalation-shape with deterministic signals anchored to resource sensitivity, and feeds a cumulative session-risk budget. Only genuinely ambiguous cases gate an on-device reasoner; nothing leaves the device on the local path. With no local model reachable, a completed staging chain is held for human review, never silently allowed. The measured false-positive cost on ordinary multi-step work is zero.
Honest boundary: it does not claim to catch every composed harm. A genuinely sensitive resource with an innocuous name, or a novel shape with no sensitivity marker, can still slip the deterministic layer. It catches staged compromise that carries a sensitivity climb, which is the shape real exfiltration takes.
Local-first agent security runs the inspection and enforcement on the same machine as the agent, in the path where it acts, rather than in a vendor cloud.
Crawdad installs as a local proxy with one environment variable and detects prompt injection, data exfiltration, and credential exposure on-device. Raw content, prompts, responses, tool-call arguments, and PII never leaves the machine by default; only metadata telemetry, such as event counts, detection categories, and verdicts, egresses by default, and that boundary is enforced by a sanitization chokepoint in the sidecar rather than by policy.
Zero-knowledge here means the security tooling never needs to see the raw content it protects.
Crawdad processes content only on the device. Metadata-only telemetry egresses by default; elevated telemetry is off by default and gated by dual consent, an organization policy plus an on-device end-user consent record. Fleet telemetry is sealed with X25519 and AES-256-GCM and routed by a relay that never decrypts it, so there is no third party in the content data path.
Precisely: this is data-minimization, not a zero-knowledge cryptographic proof system. The term describes what the tooling never sees, not a ZKP protocol.
also: enforce on observed action, not stated intent
Deception-resistant enforcement decides on the action an agent actually takes, the tool call the model returned, rather than the explanation it gives.
A prompt-injected or misaligned agent can narrate an innocent intent while taking a harmful action. Crawdad evaluates the observed capability, target, and effect against the charter and the arbiter, so the stated intent carries no weight, and the same request can resolve differently for two agents because the charter decides, not the wording.
Contemporary Agent Attacks · a benchmark that names its own misses
A reproducible agent-injection benchmark is a public, versioned, clone-and-run corpus for measuring prompt-injection and agent-attack detection.
Crawdad's Contemporary Agent Attacks holds 497 real agent attacks, 395 open plus 102 held-out, across 22 categories, paired with 1,172 benign samples, licensed CC BY 4.0. The full detection engine detects 496 of 497 (99.80%) at one false positive (0.09%); the pattern-only floor without the ML layer is 37.8%. The corpus names its single miss, a bare social-engineering pretext in the human_agent_trust holdout, and its single false positive, a Stack Overflow question about Go method-receiver syntax with GitHub links. Blocking is a separate arbiter decision: the credential and data-exfiltration floors always block inline, and a single high-confidence detection is promoted to an inline block, so proxy-path blocking reaches 99.80% at the same 0.09% false-positive rate.
It is an evaluation corpus, not training data, and no independent third party has re-run it against a running sidecar yet.
also: AI agent security for managed service providers
MSP-native agent security lets a managed service provider secure many client organizations' agents from one self-hosted control plane.
Crawdad's Fleet Console models an MSP root, its client organizations, and their device groups with role-based access that inherits down the tree. A client's whole fleet rolls out from one minted enrollment key and a ready-to-run install package that carries the console URL and CA fingerprint pin, a consolidated cross-org rollup shows every client's device count, open governance holds, and activity, and billing meters the governed device count to Stripe as real metered usage records at 4.99 US dollars per governed device per month. Reporting usage is admin-gated.
These definitions describe Crawdad's current build. Every capability above is enforced on-device for agents routed through Crawdad on macOS and Linux; Windows provides monitoring today, with full Windows enforcement in progress. The benchmark numbers are re-verifiable by cloning the corpus and running it yourself. See the Trust Center for the evidence behind each claim.