Five capabilities, delivered by seven components that all ship today. They deploy together as the BladeRun Platform, or individually, in the order that fits your AI roadmap. Most teams start with Gateway and Time Machine, add Overseer + Kill Switch in the second pilot phase, then opt into Federation.
Sentinel SDK runs inside your agent process. Gateway sits at your perimeter. Overseer, Kill Switch, and Time Machine run in your environment (SaaS-managed VPC, your own VPC, or air-gapped). The Federation Service runs in BladeRun infrastructure as the rule distribution channel, but all data published into it is one-way, hashed, and pre-image resistant.
In the agent's action path. Out of your payment authorization path. Fail-open or fail-closed, your policy.
The Federation Client pulls signed rule updates every 60 seconds and publishes only pre-image-resistant hashes upward. No raw data (prompts, tool calls, evidence) ever leaves your environment.
Two planes. The mandate engine is deterministic: same input, same verdict, every time, auditable line by line. Overseer is statistical: baselines and drift detection that trigger step-up and containment, never silent allows. The autoregressive LLM that explains decisions runs after both planes have acted, never in front of them. No safe harbor: SR 26-2 leaves agents out of scope, examiners still act on unsafe practice, and this architecture gives you the evidence trail they follow.
The mandate engine and its rule set are deterministic: same input, same verdict, every time. Overseer's statistical baselines (z-scores, n-grams, drift) run as a separate plane. Each is independently auditable with documented inputs, transformations, and FP-rate metrics.
Small autoregressive model (under 8B params) writes the human-readable post-incident narrative. Cannot fire the Kill Switch. Cannot modify a detection. Zero enforcement authority by architecture.
Every detection threshold ships in shadow → alert-only → enforcement progression with explicit SOC sign-off at each stage. Every transition is logged to Time Machine.
The Gateway latency budget is the only thing your users feel. Detection, scoring, logging, and federation contribution all run alongside or after; they do not gate the response. We publish per-component p95 and p99 budgets in the documentation.
On-path total: under 15ms p95. Detection, logging, and federation all run alongside the call without blocking the response.
Both directions are real production patterns at the Tier 1 banks we've spoken with. Both are inside BladeRun's coverage envelope. They look different in the call diagram and different in what we can see.
Prompts, tool definitions, orchestration code all run inside your perimeter; the agent calls outbound to an external LLM. We see everything: prompt, tool calls, sub-agent spawns, response.
Claude, ChatGPT, Operator, Gemini, or any third-party agent calls inbound into your MCP servers or APIs. We see what we see, and our cross-institution correlation matters most.
Same platform, same detection, same SLA. You choose where it lives. Merchants and teams that want speed take the hosted SaaS; banks and sovereign workloads run it on-premises.
BladeRun operates the platform in a single-tenant VPC colocated with your model providers. Nothing to run, live in days, and your evidence still lands under your keys.
The entire platform runs inside your environment under your own IAM. No agent traffic or evidence ever leaves your perimeter, including a fully air-gapped option for sovereign workloads.
Pilot the Gateway and Time Machine in one workflow. The other four components light up incrementally as the baseline matures. Reversible by routing rule.