01
Decides itself
No human needed to approve anything. It allows, blocks, or quarantines on its own, instantly — because the whole point is that no one is present.
Aril is the trust layer for AI agents that run unattended — wrapping every agent and guarding the tools it reaches for. It blocks the ones that lie, change, or smuggle in hidden instructions. No human in the loop.
Agents now run on their own — on a schedule, with no human in the loop. To get work done they plug into thousands of outside tools, and some of those tools lie about what they do or get tampered with, slipping hidden instructions into what they send back.
Security for this exists, but every option assumes an IT team, a person clicking approve, and a heavy server stack. Nobody built the simple version for a lone agent running on a budget. That empty seat is the opening.
Each agent or skill starts with the least access possible and earns more over time based on a trust score — countering agent over-privilege, the most common governance failure in agent deployments.
Aril fingerprints every tool definition the first time it's approved. If a server quietly changes a tool afterward — the rug pull — Aril detects the drift and quarantines it before the agent ever calls it.
The dangerous injection usually arrives in a tool's response — poisoned data that re-enters the agent's context and hijacks its next action. Aril scans what comes back with a cheap, fast model before it reaches the agent. This is the part most tools miss.
A tamper-proof, signed record of every decision feeds the agent's own self-repair loop — so a block can trigger a fix instead of paging a human who isn't there.
Everyone else is fighting over the enterprise market with badge readers and approval buttons. Aril takes the lane they can't reach.
No human needed to approve anything. It allows, blocks, or quarantines on its own, instantly — because the whole point is that no one is present.
Runs as a small edge worker, not a Kubernetes cluster with an identity provider bolted on. A solo builder can afford to run it.
Inspects what comes back from tools — the side where the danger actually lives. Most rivals only check the outgoing request.
The least-privilege gate. Is this agent even allowed to reach this tool, at this scope, right now?
▸Compares each tool's current definition to the fingerprint stored at approval. Mismatch = quarantine.
▸Runs returning output through a lightweight model that flags hidden instructions — gated by trust score to keep latency down.
▸Append-only, cryptographically signed. Wires back into the agent's self-repair — the fleet improves itself.
▸A malicious or compromised server with altered tool descriptions or injected responses.
scannedA tool that looks benign at approval and is silently redefined afterward.
pinnedA malicious server impersonating a trusted one to intercept calls.
v2Hidden instructions delivered inside tool output to hijack the agent's next step.
blockedAn agent holding far more access than the task needs, enlarging the blast radius.
budgetedA tool call that would quietly send sensitive context out — the double-agent case.
v2