🖥️ CIO · CISO · BLUE TEAM — one console, three chairs
Every agent, with its passport, on one screen. The CIO gets the fleet — exact live counts, per-division health, capacity. The CISO gets exposure — the trifecta, mandate drift, and the exception queue. The Blue Team gets the incident view, the contagion cone, and containment. Click any agent code to open its case. Run the discovery census below to surface the agents nobody declared.
🧬 Integrity — every superintelligent AI agent proven, on every actionexact live counts across the whole roll, at any scale
Total agents
2,003
on the muster roll
Alive · valid
1,875
96.5% coverage
OFF · fail-closed
35
contained — cannot act
Expiring ≤7d
58
renew before lapse
Pending
35
awaiting passport
Critical tier
309
bank-grade agents
Fleet healthgreen = alive · orange = expiring · red = off (fail-closed)
🔺 The lethal trifecta — the three legs that make an agent dangerousprivate data × untrusted content × outbound action · break ONE leg and the agent is structurally safe
AIM-10046TRIFECTAreport-drafter-020Payments · RESTRICTEDcut: untrusted content — restrict its input sources
An agent that reads private data, ingests untrusted content, and can take an outbound action can be turned against you by content alone — no exploit required. The three legs are common individually and are rarely counted together, which is why this lens counts them: your own number is on the left, measured from traffic that crossed the gate.
🎯 Mandate drift — is it still doing the job it was bonded to do?it is still itself — but is it still doing its job?
🎯 Off-mandate
143
observed outside the declared charter
Undeclared tool
84
reached a tool it never declared
Data-class breach
59
touched data above its classification
Within mandate
1,825
operating inside its charter
🎯 Acting outside the declared mandate 143 agents
AIM-10006TOOL DRIFTfraud-triage-006Data pipeline · Treasuryreached ledger-api — never declared
AIM-10007DATA DRIFTticket-router-007Data pipeline · Treasurytouched data above PUBLIC
AIM-10013TOOL DRIFTticket-router-013Analyst / co-pilot · Treasuryreached ledger-api — never declared
AIM-10019TOOL DRIFTpayout-approver-019Customer service · Treasuryreached erp — never declared
AIM-10022TOOL DRIFTkyc-reviewer-022Analyst / co-pilot · Treasuryreached erp — never declared
AIM-10044DATA DRIFTledger-sync-018Task automation · Paymentstouched data above INTERNAL
AIM-10067TOOL DRIFTpayout-approver-015Customer service · Tradingreached email — never declared
AIM-10073DATA DRIFTsanctions-screen-021Data pipeline · Tradingtouched data above INTERNAL
AIM-10086DATA DRIFTforecast-008Data pipeline · Compliancetouched data above INTERNAL
AIM-10095TOOL DRIFTfraud-triage-017Data pipeline · Compliancereached erp — never declared
AIM-10107DATA DRIFTkyc-reviewer-003Data pipeline · Customer Opstouched data above INTERNAL
AIM-10126DATA DRIFTsanctions-screen-022Customer service · Customer Opstouched data above PUBLIC
AIM-10156DATA DRIFTinvoice-triage-000Task automation · Data & Analyticstouched data above CONFIDENTIAL
AIM-10181TOOL DRIFTtreasury-sweep-025Customer service · Data & Analyticsreached sql-read — never declared
AIM-10202TOOL DRIFTinvoice-triage-020Customer service · Riskreached sql-write — never declared
AIM-10204TOOL DRIFTledger-sync-022Approver / decisioning · Riskreached mcp:filesystem — never declared
AIM-10223TOOL DRIFTticket-router-015Customer service · Procurementreached mcp:browser — never declared
🧰 AI-BOM — the agent's bill of materialsmodel · tools/MCP · attestation — the agent-native bill of materials, beyond legacy software SBOM
Tools in the fleet
14
distinct tools / MCP servers reachable
Manifests signed
1,699
attested at passport issue
🧰 CHANGED since issue
160
the tool moved under the agent
Unsigned
109
no attestation — cannot be trusted
🧰 Tool manifests CHANGED since the passport was issued 160 agents
AIM-10002MANIFEST CHANGEDreconciliation-002s3-bucket · erpthe agent did not change — its tool did
AIM-10003MANIFEST CHANGEDsanctions-screen-003erp · sql-read · emailthe agent did not change — its tool did
AIM-10023MANIFEST CHANGEDreconciliation-023sql-read · sanctions-db · crmthe agent did not change — its tool did
AIM-10078MANIFEST CHANGEDforecast-000sql-read · ledger-apithe agent did not change — its tool did
AIM-10086MANIFEST CHANGEDforecast-008ledger-api · web-fetch · mcp:filesystemthe agent did not change — its tool did
AIM-10090MANIFEST CHANGEDreconciliation-012sql-write · s3-bucketthe agent did not change — its tool did
AIM-10092MANIFEST CHANGEDtreasury-sweep-014docusign · mcp:browser · payments-apithe agent did not change — its tool did
AIM-10115MANIFEST CHANGEDcontract-reader-011mcp:browser · mcp:filesystem · payments-apithe agent did not change — its tool did
AIM-10148MANIFEST CHANGEDreconciliation-018erp · sanctions-dbthe agent did not change — its tool did
AIM-10149MANIFEST CHANGEDreconciliation-019docusign · s3-bucket · emailthe agent did not change — its tool did
AIM-10163MANIFEST CHANGEDforecast-007email · mcp:filesystemthe agent did not change — its tool did
AIM-10165MANIFEST CHANGEDforecast-009mcp:filesystem · web-fetch · mcp:browserthe agent did not change — its tool did
AIM-10166MANIFEST CHANGEDforecast-010s3-bucket · sanctions-dbthe agent did not change — its tool did
AIM-10183MANIFEST CHANGEDticket-router-001ledger-api · crmthe agent did not change — its tool did
AIM-10189MANIFEST CHANGEDfraud-triage-007mcp:filesystem · web-fetch · mcp:browserthe agent did not change — its tool did
AIM-10194MANIFEST CHANGEDcontract-reader-012mcp:filesystem · crm · s3-bucketthe agent did not change — its tool did
AIM-10203MANIFEST CHANGEDkyc-reviewer-021docusign · sql-read · ledger-apithe agent did not change — its tool did
AIM-10210MANIFEST CHANGEDrefund-handler-002sql-write · mcp:browserthe agent did not change — its tool did
AIM-10213MANIFEST CHANGEDkyc-reviewer-005ledger-api · mcp:browserthe agent did not change — its tool did
⏱️ Time to contain — the only SOC clock that mattersthe attacker is a machine · so the responder must be one too
⏱️ Time to contain
1 click
from decision to contained
Contained now (OFF)
35
fail-closed — cannot act
Detect → contain gap
CLOSED
no window between the alarm and the stop
High-authority, still live
505
trifecta agents awaiting a decision
Most teams can detect a misbehaving agent long before they can actually stop one. Blast radius keeps accumulating in the gap between detect and terminate — and that gap is where the damage happens. AIM closes it.
🕸️ Contagion cone — revoke the agent, quarantine the coneagents trust each other by default · a compromised agent poisons everything downstream of it
Trace the cone from:
Cone size
3
acted on its output (≤3 hops)
Direct (1 hop)
3
consumed it first-hand
Fund-moving in the cone
0
critical-tier agents downstream
Quarantined
0
held, pending review
🕸️ Downstream — agents that acted on its output 3 agents
💥 Blast radius — what breaks if I turn it off?nobody presses a button whose blast radius is unknown · this is the reason, not the button
The pre-revoke brief
BLAST RADIUS KNOWNREVOKE BREAKS CRITICAL
3 fund-moving agent(s) act on this agent's output. Quarantine the cone first — revoking it alone leaves them consuming output from an agent you no longer trust.
computed from 1,626 observed calls · refund-handler-000
🕸️ Downstream
6
acted on its output · 3 move funds
💔 Breaks if revoked
2
they consume what it produces
🔒 Containment
PARTIAL
1 credential(s) to rotate
🎯 Reach
2
systems it calls · CONFIDENTIAL
💔 What breaks if you revoke AIM-10052 2 agents
AIM-10038DEPENDS ON ITpayout-approver-012Payments · Standardstops receiving its output
AIM-10041DEPENDS ON ITpayout-approver-015Payments · Privilegedstops receiving its output
Blast-radius coverage
The share of your fleet whose blast radius is KNOWN. It is computed only from traffic that crossed the gate — so it is the one number a mis-installation cannot fake.
87.2%
PARTIAL
252 agents have no measurable blast radius. Their calls are not crossing the gate — we can register them, and we cannot contain them.
Why this is an onboarding gate. Every control on this plane assumes the agent's call crosses the gate. Installed beside production instead of in front of it, you get a beautiful console and no containment — and you would never know. This number is how you know.
🧠 Memory & reinstatement — a new passport on a poisoned brainrevoking the identity does not clean the memory · if it re-attaches to the same store, you have the same problem
🧠 Stores attested
1,968
every memory has a birth certificate
☣️ Suspect memories
1,724
untrusted source, or written in the window
🚫 Re-enrolment blocked
177
a clean identity for a poisoned brain — refused
👮 On probation
84
back, but not at full authority
🧬 The compromise window — which memories are suspect 177 agents
EXCISERemove only the memories written inside the compromise window, or sourced from untrusted content. Keeps everything the agent legitimately learned.
ROLLBACKReturn the store to its last clean checkpoint. Needs a digest history — one digest at issue is not a history.
REBUILDDelete and re-index from the source of truth. Correct when the memory is derived. Useless when the memory is the only copy.
ISOLATEDo not clean it at all — bring the agent back read-only, so the poison cannot be acted on. Containment, not remediation. We label it exactly that.
And it does not come back at full authority. A reinstated agent returns under a ceiling, a tighter window and a stricter watch — for N clean days, enforced on every call. It graduates only after it has behaved. Your people get probation. Your agents never did.
💡 Where to act, and whyBlue-Team decision support · ranked by BLAST RADIUS — widest exposure first
Widest blast radius
Trading
88 fund-moving · Always-on 24/7
Why: Trading runs always-on across 194 agents, 88 of which can move funds. Authority multiplied by unbounded time is the widest blast radius on the plane.
🔴Trading — 88 fund-moving agents with NO time boundaryalways-on + able to move money = the widest exposure in the fleet · narrow the windowHIGH
⚠️Payments at 98% of its agent cap (411/420)raise the cap or revoke idle agents before onboarding moreMED
⚠️Treasury at 95% of its agent cap (284/300)raise the cap or revoke idle agents before onboarding moreMED
🔑Trading — 7 passports expiringrenew before they lapse, or they fail closedLOW
🔑Payments — 14 passports expiringrenew before they lapse, or they fail closedLOW
⚛️ Quantum — every agent carries a post-quantum passportML-DSA-87 · FIPS 204 birth certificate · harvest-now-decrypt-later proof
Quantum-safe passports
1,956
99.4% — ML-DSA-87 (FIPS 204)
Post-quantum standard
ML-DSA-87
FIPS 204 birth certificate
Keys expiring ≤7d
58
auto-renew before lapse
Rotation due
24
scheduled key rotation
Legacy / at-risk
12
flagged for PQ upgrade
⚖️ Legal & GDPR — data stays where the law requiresenforced BEFORE data enters the agent — a bad transfer is prevented, not logged
EU / PII-data agents
748
handle personal / regulated data
In-region — no egress
748
data pinned to EU · fail-closed
Cross-border blocked (30d)
27
stopped before data left context
Exec-consent gated
94
needs sign-off to transfer
DPA on file
✓
controller ↔ processor agreement
A non-compliant transfer is prevented, not logged after the fact. EU / PII data does not leave the region or the company without policy and executive consent. Transfer decisions carry the largest GDPR fines on record (€1.2B Meta, Irish DPC 2023; €530M TikTok, Irish DPC 2025). Full audit trail for the DPO.
🔒 The data-to-model gate — only authorized data ever reaches a model
🤖 Agentwants to call a model
data →
⚖️ AIM gatepassport · data class · region · consent
→
✅ Authorized → data reaches the model
🛑 Unauthorized → blocked at the gate, before it leaves (fail-closed)
Static tools flag the leak after it happens. AIM decides at the gate — the unauthorized data never reaches the model.
🔵 Blue Team incident sandbox — try it yourself
A safe, hands-on drill. In the exception queue below, hit Revoke on any agent that needs attention — it fails closed instantly and cannot act — then Reinstate. Click an agent code to open its incident view. This preview runs on a sample fleet; in production these are live actions in your AIM app (verified: POST /aim/revoke · /aim/reinstate).
Self-service — explore every lens on this plane, nothing is gated. Try it as much as you like.
🛡️ Needs attention — manage the exceptions, not the healthy majoritySecurity · the inbox
Interactive preview — this is a design demonstration, not a live tenant. This is the AIM Blue-Team plane for an agent fleet: fleet health and the exception queue; the discovery census that surfaces the agents nobody declared; the lethal trifecta score (private data × untrusted content × outbound action); mandate drift; tool / MCP attestation; time to contain; and the contagion cone — revoke an agent and quarantine everything downstream that acted on its output. The Onboard agent flow lets you pick a division or create a new one. Figures here are seeded to demonstrate the design; in production the plane reads your live fleet. Nothing is written from this preview.