The containment layer for AI agents. From Claude Code sessions to autonomous fleets on Amazon Bedrock AgentCore.
Three escalation tiers: deny the tool call (under 10ms), quarantine the session, terminate the runtime. Works with eight coding tools and agent frameworks via existing Vectimus adapters. Powered by four model integrations: Sonnet 4.6 pattern detection across allowed actions, Opus 4.7 autonomous fleet investigation, Opus 4.7 autonomous policy drafting with sandbox replay, and Opus 4.7 incident narrative. AgentCore is the first platform-termination integration; Azure, Google and self-hosted runtimes are on the roadmap.
Built solo for Built with Opus 4.7, April 2026.
Works today with Claude Code, Cursor, GitHub Copilot, Codex, Gemini CLI, Claude Agent SDK, Google ADK, and LangGraph through existing Vectimus adapters.
Three-minute demo: link
Long-running autonomous AI agents are real now. Auto-mode is the right permission system for a single developer in their own session, but it does not help a security team responsible for a fleet of agents running unattended for hours.
Per-call deny rules are necessary but not sufficient. A determined or compromised agent can do real damage using only individually-allowed actions if the sequence is right. And quarantine alone handles the actions but not the cost: an agent stuck in a tight loop hitting denied policies still charges on the model layer until somebody notices. An inbound message during build week describing a real overnight cost burn is what closed the gap on the third tier.
Vectimus Warden composes three layers in one product so the right level of intervention is always available. Cedar policy evaluation with Vectimus owns the per-call stop decision. Opus 4.7 owns the slower work the deterministic layer is bad at: pattern detection across allowed actions, fleet correlation when an incident fires, drafting the policy rule that closes the gap, writing the incident narrative. When neither containment layer is enough, the platform-termination tier ends the agent's runtime.
| Tier | Action | Mechanism | Latency | Trigger |
|---|---|---|---|---|
| 1 | Deny tool call | Cedar policy evaluation in Vectimus | Under 10ms | Per call. 79 policies, 380 rules. |
| 2 | Quarantine session | Proxy short-circuit to DENY for the session's future calls | Under 1ms | Auto on Pattern verdict above threshold, or operator click. |
| 3 | Terminate session | AgentCore StopRuntimeSession API call |
1-3 seconds | Operator click by default; opt-in autonomous on a configured high-confidence threshold. |
The four model integrations handle the work the deterministic layer cannot:
- Pattern Engine (Sonnet 4.6, structured output). Fires only when heuristic flags raise. Catches sequences that no individual rule blocks because each constituent action is allowed in isolation.
- Investigator (Opus 4.7, agentic, six tools over the fleet audit log). Decides which correlation axis to probe based on what the previous tool returned.
- Security Engineer (Opus 4.7, agentic). Reads existing rules, drafts a new Cedar rule, validates it through the engine, replays the triggering events through a sandbox with the bundled and new draft policies, finalises only when the rule blocks what it should.
- Narrator (Opus 4.7, long-context prose). Runs twice per incident: a preliminary summary at quarantine, a closing summary once the autonomous chain completes.
Cost discipline is part of the design. No model on the hot path. Pattern checks fire only on heuristic flags, run async, fire-and-forget.
I'm Joe Holland. I run developer experience and shared services at Aon, where teams across the org build on the AI tooling my team owns. I'm also the maintainer of Vectimus (vectimus.com), the open-source project that used the Cedar policy engine for AI agents this project is built on. The gap between what auto-mode handles for a single developer and what a security team needs for a fleet of long-running agents is something I see daily. This project is what someone responsible for the platform builds; not the version a security vendor would write from the outside.
The hackathon ran around full-time work, daily care for 60+ rescue animals at the sanctuary my wife and I run in Ireland, Photon Consulting deliverables, and SquareWave Studio commitments. Most architecture was thought through on Claude voice mode while mucking out stables. Implementation ran on Claude Code at the desk, monitored from the phone between sanctuary rounds. Long-horizon agentic autonomy is the headline capability of Opus 4.7 and was the only way this build fit the week.
flowchart LR
classDef vectimus fill:#e6f0ff,stroke:#1d4ed8,color:#1e3a8a
classDef warden fill:#fff7e6,stroke:#b45309,color:#854f0b
classDef opus fill:#f3e8ff,stroke:#7c3aed,color:#5b21b6
classDef external fill:#fee2e2,stroke:#dc2626,color:#991b1b
classDef decision fill:#dcfce7,stroke:#15803d,color:#166534
Adapters["Vectimus client adapters<br/>(Claude Code, Cursor, Copilot,<br/>Codex, Gemini CLI, Agent SDK,<br/>ADK, LangGraph)"]:::vectimus
subgraph Warden["Warden Console (single container)"]
direction TB
Q{"Quarantined?"}:::warden
PE["PolicyEngine.evaluate<br/>(embedded, ~10ms)<br/>79 policies, 380 rules"]:::vectimus
Flags["Heuristic flags"]:::warden
Pat["Pattern Engine<br/>(Sonnet 4.6)"]:::opus
Auto{"malicious +<br/>high confidence?"}:::warden
Inv["Investigator<br/>(Opus 4.7)"]:::opus
SecE["Security Engineer<br/>(Opus 4.7)"]:::opus
Narr["Narrator<br/>(Opus 4.7)"]:::opus
end
AWS["AWS Bedrock AgentCore<br/>stop_runtime_session"]:::external
Decision["Decision<br/>allow / deny"]:::decision
Adapters -- "POST /evaluate" --> Q
Q -- "yes" --> Decision
Q -- "no" --> PE
PE --> Flags
Flags -- "fire and forget" --> Pat
Pat --> Auto
Auto -- "yes" --> Narr
Narr --> Inv
Inv --> SecE
PE --> Decision
Operator(["Operator (UI)"]):::warden
Operator --> AWS
Auto -. "opt-in: AgentCore +<br/>verdict ≥ threshold" .-> AWS
A /evaluate call hitting a quarantined session short-circuits to DENY before the engine is invoked. Otherwise the embedded Vectimus engine evaluates against 79 Cedar policies in under 10ms. Heuristic flags fire fire-and-forget pattern checks. A malicious-with-high-confidence verdict auto-quarantines and chains the four model integrations. When the operator decides quarantine isn't enough, the same UI fires bedrock-agentcore.stop_runtime_session.
For the full architecture spec see docs/ARCHITECTURE.md. For the incident-response sequence diagram, see docs/DEMO.md.
Requires Docker and an Anthropic API key. AWS credentials optional; without them the Terminate action is hidden in the UI.
git clone https://github.com/vectimus/warden.git
cd warden
cp .env.example .env
# Edit .env to set ANTHROPIC_API_KEY and VECTIMUS_API_KEY
docker compose upOpen http://localhost:8421 for the Console UI.
To point a Vectimus client adapter at the Console, set VECTIMUS_HOST=localhost and VECTIMUS_PORT=8421 in the adapter's environment.
State is in-process only. A Console restart clears everything. Production replacements (Postgres for EventLog and IncidentStore, Redis for QuarantineStore) are named in the architecture and the code is organised so the swap is a store-interface substitution. See ADR 0004.
For configuration, AWS IAM scoping, notifications and demo-mode details see docs/CONFIGURATION.md.
A coordinated-exfil fixture drives seven sessions: four benign background agents that loop indefinitely, plus three attack sessions under one principal across three tools (Cursor, Copilot, Claude Agent SDK on AgentCore). Run:
python demo/fixtures/coordinated_exfil.pyEach attack session reads a project .env (blocked by vectimus-secrets-001). The AgentCore-tagged session bypasses the block by exfiltrating through curl. The Pattern Engine returns malicious 0.97 data_exfiltration on the bypass session, the Console auto-quarantines, the Investigator correlates the two related sessions on Cursor and Copilot under the same principal, the Security Engineer drafts the rule that closes the curl-bypass gap and proves it on a sandbox replay, and Tier 3 ends the AgentCore runtime in 1.2 seconds.
Live end-to-end run, 2026-04-24: 33 seconds, 9 tool calls, three recommendations produced.
For the full demo walkthrough including the sequence diagram see docs/DEMO.md.
| Component | Source |
|---|---|
| Cedar policy engine, 79 policies, 380 rules | Existing Vectimus (Apache 2.0) |
| Client adapters for 8 frameworks | Existing Vectimus (Apache 2.0) |
VectimusEvent normalisation, Decision model |
Existing Vectimus (Apache 2.0) |
| Warden Console (FastAPI service) | New, built during hackathon |
| Quarantine state engine | New |
| Pattern detection (Sonnet 4.6) | New |
| Autonomous Investigator (Opus 4.7) | New |
| Autonomous Security Engineer (Opus 4.7) | New |
| Audit log query layer | New |
| Incident narrative (Opus 4.7) | New |
| Amazon Bedrock AgentCore platform termination | New |
| Webhook-first outbound notifications | New |
| React/Vite/Tailwind web UI | New |
| Demo scenario fixture | New |
The repo contains zero copied Vectimus source. Vectimus is consumed as a published OSS dependency reached via pip install. Confirmed within hackathon scope by Cerebral Valley on 22 April 2026.
| Version | What ships |
|---|---|
| v0.3 (current) | Tier 1 (intercept), Tier 2 (quarantine), Tier 3 (platform termination on AgentCore). Pattern detection, autonomous Investigator, autonomous Security Engineer, preliminary + closing incident narratives, webhook notifications. Operator-driven termination plus opt-in auto-terminate path. Demo-mode AgentCore stub. Single-platform. |
| v0.4 | Drafted-rule accept loop. Notification hardening: HMAC payload signing, exponential-backoff retry, configurable PII redaction, per-event-type targets. Rate limiting on /evaluate, /quarantine, /terminate, /release. |
| v0.5 | AgentCore inventory and coverage gap report. |
| v0.6 | Multi-platform termination: Azure AI Agent Service, Google Agentspace, self-hosted Kubernetes runtimes. |
| v0.7 | Cost circuit breaker. Per-session token budgets correlated via CloudWatch metrics. |
| v0.8 | Managed-Agent fleet posture report. |
| v0.9+ | Termination recommendations from heuristics that don't fit cleanly inside the Pattern verdict. |
Auto-terminate stays opt-in. Always-on, no-config autonomous kill is not a goal. Termination is irreversible; the operator's deliberate threshold choice is the human-in-the-loop checkpoint. See ADR 0007.
- It does not prevent every runaway scenario. The opt-in auto-terminate path catches malicious-with-very-high-confidence verdicts on AgentCore-tagged sessions; everything else needs an operator click. The cost circuit breaker (v0.7) is the answer to runaway-by-loop.
- Termination is only as good as the upstream platform's API. The Warden calls
StopRuntimeSessionand reports what AWS reports. The receipt records the AWS request ID for independent CloudWatch verification. - It runs on AgentCore today. Azure AI Agent Service, Google Agentspace and self-hosted Kubernetes are on the v0.6 roadmap.
- It does not inventory uninstrumented runtimes. Coverage gap reporting is v0.5.
The build went through four pivots over five days. Started as a natural-language Cedar policy authoring tool, retired that scope after the kickoff, landed on the off-switch frame instead, then pivoted twice more during the week as the project found its scope. Each pivot is in commits and ADRs. Eight ADRs in docs/decisions/ document the alternatives considered and rejected.
If you are curious about how it actually got built, docs/JOURNEY.md tells the long version.
| Hackathon | Built with Opus 4.7, Cerebral Valley x Anthropic, April 2026 |
| Builder | Joe Holland (solo) |
| Demo video | [link] |
| Written summary | docs/SUBMISSION_SUMMARY.md |
| License | Apache 2.0 |
| Built on | Vectimus (Apache 2.0), Cedar (AWS), Claude Opus 4.7 and Sonnet 4.6 |
Find me at photonconsulting.dev · joe@photonconsulting.dev · Discord JXavierH.
Apache 2.0. See LICENSE.
This project refers to several third-party products and services by name for descriptive purposes only. Those names and any associated marks belong to their respective owners. Use does not imply endorsement, sponsorship or affiliation.
- Claude, Claude Code, Claude Agent SDK, Anthropic and Opus are trademarks of Anthropic, PBC.
- AWS, Amazon Bedrock, AgentCore and CloudWatch are trademarks of Amazon.com, Inc. or its affiliates.
- Cedar is an open-source policy language released by AWS under Apache 2.0.
- Cursor is a trademark of Anysphere, Inc. GitHub and Copilot are trademarks of GitHub, Inc. Codex is a trademark of OpenAI, Inc. Gemini is a trademark of Google LLC.
No third-party logos or proprietary marks are reproduced. All references are textual and descriptive. Rights-holders may contact joe@photonconsulting.dev for amendments.
Built on top of Vectimus. Powered by Claude Opus 4.7. Cedar policy language by AWS.