Skip to main content

Security & compliance

Built so your security team says yes.

emisar exists because giving an LLM raw shell access is reckless. Every layer here is designed so the LLM is the least-privileged participant in the system — and every action is auditable.

No inbound port on hosts Pattern redaction before egress No shell unless you install one

Trust boundary

Who can do what, by design.

The LLM is never trusted with privileged execution.

LLM client untrusted

Claude, Cursor, or ChatGPT asks for one catalog action over MCP — with a required reason. Undeclared commands don't exist to it. The one pack that runs an arbitrary script is staging break-glass: critical risk, denied by default until you opt in.

trust boundary
The gate · control plane require approval approved

Evaluates policy, checks scope and pack trust, routes, and writes the audit. A risky action waits for a human — and it never executes a shell itself.

with signed dispatch
Runner · on your host

Outbound WSS only — the host dials out, nothing listens. A non-root service user re-validates every argument against the schema, re-verifies the pack hash, drops to least privilege, runs argv arrays, and redacts before egress.

Hash-chained journal + cloud audit

Portal audit records the decision and execution metadata. Run history retains bounded redacted output; the separate host journal keeps bounded previews and complete-stream digests in a SHA-256 chain.

The dashed line is optional and per runner: with signed dispatch, the runner trusts the bridge's signature on the MCP call, not the control plane above it — a compromised cloud can relay it, never forge it.

The approval loop

Watch one risky action cross the gate.

Claude proposes a config reload on a production edge host.
Here is everything that happens next.

Step 1 · Held

A pending approval in the emisar console: Claude, for Maya Chen, asks to run caddy.reload_config on the edge-fra-01 runner. The page shows the action's high risk, the exact command, the reason, the policy that held it, and Approve / Deny controls.

Policy holds the agent's request for a human — the exact command, the reason, and the risk on one screen.

Step 2 · Decide

The same approval with the note typed into Your decision: “validated config, active connections drained, deploy window open”.

Jordan reviews and writes the note the record will keep.

Step 3 · Approved

The request after the click: approved by Jordan Lee, with the note preserved as the decision reason.

Approved — decider, time, and reason on the record.

Step 4 · Executed

The run detail for the approved action: success on edge-fra-01 with exit code 0, the approval decision inline, the executed command marked secrets redacted, and the captured output.

Only now does the runner execute: exit 0, output scrubbed on the runner before it left the host.

Step 5 · Recorded

The audit log opened from View audit trail, pre-filtered to this dispatch's request-id trace: Run succeeded and Run awaiting approval for caddy.reload_config on edge-fra-01.

Seconds later, the run is in the audit log.

Step 6 · Evidence

The audit event detail for Run succeeded: when, event id, request id, actor Maya Chen, target runner edge-fra-01 with a link to the run, and the full JSON payload including the executed command and exit code 0.

The evidence one click deep — actor, target, request id, payload — exportable to your SIEM.

Demo uses real screenshots of the product.

Data handling

Boring, defensible defaults.

TLS-only transport

Runners connect to the control plane over WSS using TLS 1.2+. An enrollment key — single-use by default — is exchanged for a per-runner token that can be revoked from the console.

No inbound connections to runners

Runners are outbound-only. No ports to expose, no firewall holes, no NAT traversal. Your hosts initiate every connection.

Hash-chained audit journal

Every action is recorded to an append-only JSONL audit on the host, with each line carrying the SHA-256 of the previous entry. Verification covers the retained journal or retained suffix; it cannot prove that a privileged host operator did not replace or truncate the entire local journal.

Hash-pinned packs

Action packs are content-addressed. A hash the published catalog carries is trusted on sight; a custom or changed one blocks dispatch until an admin reviews the contents. Before execution, the runner recomputes the control-plane-pinned hash and rejects a mismatch.

Pattern redaction before egress

20 built-in patterns — common provider tokens (GitHub, Slack, Stripe, OpenAI, …), JWTs, bearer and basic auth, private-key blocks, and secret assignments — plus your own per-action rules scrub stdout and stderr on the runner before anything is forwarded. The control plane receives only the redacted stream. A novel secret shape can still pass a pattern-based filter, so this is defense in depth rather than a guarantee that every secret is recognized.

SIEM export

The cloud audit is the searchable system of record. Your SIEM can poll it continuously through a dedicated read-only credential.

Organizational controls

The knobs your IAM team expects.

RBAC

Roles for owner, admin, billing manager, operator, and viewer, plus per-user runner, runner-group, and pack scopes.

Governed LLM access

MCP bridge keys are short-lived and rotate themselves. Runner credentials rotate automatically and can be revoked independently.

MFA

TOTP MFA is available on every plan, with one-time recovery codes and replay protection. Enforce it org-wide with one switch.

SSO & SCIM

OIDC sign-in with Okta, Entra ID, JumpCloud, Google Workspace, or Keycloak, plus SCIM directory sync. Offboard someone in your IdP and their emisar sessions and keys are revoked automatically.

Independent standard

Built for “assume breach.”

Anthropic — the lab behind Claude — published Zero Trust for AI Agents, a framework for giving autonomous agents access to real systems: least agency, deny-by-default tools, human approval for high-risk actions, and a tamper-evident audit trail. emisar enforces that control set — and assumes the agent may already be compromised, so a jailbroken or prompt-injected model still can't exceed the declared, gated, audited catalog.

Not affiliated with or endorsed by Anthropic. We cite the framework as an independent security reference.

Local admission control

Beyond the cloud policy, an operator can set an allow/deny list on the runner itself. Denied actions are hidden from the catalog and refused at execution — fail-closed, even against a compromised control plane. The host always has the last word.

Signed dispatch — the cloud can't act for you

A runner can be set to refuse the control plane's authority entirely. A customer-authorized bridge signs each request with a key the control plane never holds. A fully compromised emisar control plane can relay that signed request — it can never forge, alter, replay, or originate one. The signature, not the cloud, is the authority. Opt-in per runner.

Set it up — generate keys, distribute, rotate, revoke 

Responsible disclosure

Found a security issue? We want to hear about it. Email security@emisar.dev with a description and reproduction steps. We acknowledge reports within 72 hours and credit reporters in our security advisories.

Full policy in SECURITY.md.

Ready to evaluate emisar for your team?

Start free on the Free plan, or book a walkthrough and bring your security team's questions.

Three runners. Seven-day audit. No credit card.