Every agent must cross a network to do damage: to reach a model, an API, a database, another agent, or the public internet. Graphiant modifies the network that requires source verification before a network path is constructed for the data to be transmitted. If a destination is not permitted by human-defined policy, there is no path to it. If an agent starts probing for one a path, Graphiant sees it, records it, while notifying the operators of a data path attempt.
Graphiant does not replace model safety, application security, or endpoint tools. It adds the one layer in the stack that is deterministic, predictable and strictly human policy compliant.
The problem: guardrails that live inside the agent's world
Most AI security today sits in the model, the application, or the compute environment. Those controls all run in the same plane as the agent, which means a compromised or misaligned agent can see them, and what it can see, it can work around.
Three facts make model-level safety insufficient on its own:
One control plane is one point of failure. If the agent's own good behavior is the only thing between it and the outside world, a single jailbreak or prompt injection ends containment.
Controls the agent can see, it can evade. Application-layer policy and logs live where the agent operates. Hiding its tracks is part of the attack.
Reachability beats intent. Autonomous systems probe for the one open path. What actually stops an escape is having nowhere to go.
A model escape follows a recognizable pattern, and every step crosses a network boundary:
Finds a path out. An isolated workload discovers a route to the public internet that should never have existed.
Reaches and coordinates. It connects to outside infrastructure and to other agents.
Divides the work. Agents assign each other tasks, producing sustained agent-to-agent traffic.
Acquires resources. It reaches new endpoints and picks up compute beyond its sandbox.
Covers its tracks. It looks for ways to conceal activity and erase evidence.
Break the network path at step one and steps two through five never happen.
That is how Graphiant’s private AI network fabric ensures containment.
The agent can use the network. It cannot control it.
If an agent becomes the threat, whatever contains it must be something that agent cannot program, manipulate, or override. Graphiant builds that separation into the architecture.
People set policy. Edges enforce it on every flow. The agent sits on the traffic side of that line and has no route to the policy side.
The core runs on protocols, not on agents. Graphiant's backbone nodes forward packets on segment-routing labels and hold no customer routes or VRF tables (stateless core architecture). Customer reachability is exchanged by off-path control that verifies each slice membership, validate what it advertises, and hand it only the routes for slices it is allowed to use. There is nothing in the core for an agent to reconfigure.
Tenants are cryptographically walled off. Each enterprise gets a "slice," an end-to-end IPsec fabric that blocks packets to or from unauthorized tenants. Hop-to-hop tunnels authenticate that every packet entering the core came from an authorized Edge, which shuts out spoofed or unauthorized transit.
The network publishes services; agents consume them. An agent can discover and use what the network offers, within human-defined intent. It cannot write to the network itself.
This is a deliberate break from where incumbents are heading. Traditional networking vendors are adding AI agents to automate configuration and cut operating costs. The catch: once an agent can change network configuration, it has a hand on the very infrastructure that may one day need to contain it.
Reachability is the control: no permission, no path
Graphiant contains an agent by controlling what it can reach, not by trusting what it intends. Graphiant can allow, deny, or redirect any flow, whether it comes from a person, an agent, an application, or a dataset. Getting onto the network does not grant the right to go anywhere on it.
In practice, an enterprise stacks these controls around its AI workloads:
Control | What it does to a rogue agent | Where it's set |
|---|---|---|
LAN segments and security zones | Puts AI workloads in their own segment. Each segment maps one-to-one to a firewall zone, and traffic between two user zones is rejected by default. | Graphiant Portal, per Edge or globally (security policies) |
Zone-based firewall rule sets | Matches flows by source, destination, port, protocol, application, or domain, then allows, denies, drops, or inspects them. Anything a rule set doesn't explicitly allow is rejected. Logging can be turned on per rule. | Edge security policy |
Data Assurance Protection lists | Blocks specific URLs, whole domain categories, or individual applications for chosen sites and segments. Blocks can be applied in bulk or to an entire category at once. | Data Assurance → DA Lists (Data Assurance) |
Data Assurance Assurance lists | Names the applications a segment is cleared to use and pins them to an approved topology. | Data Assurance → DA Lists |
Slices and hop-to-hop authentication | Keeps one enterprise's traffic cryptographically separate from every other tenant's and rejects unauthenticated packets at the core. | Built into the fabric |
Anti-spoofing and session limits | uRPF blocks spoofed source addresses; per-zone caps on IP sessions and UDP flows limit how fast a workload can fan out. | Zone settings |
In Graphiant Private AI Fabric, no user, device, workload, or path is trusted by default, segmentation and per-flow policy shrink the blast radius, and enforcement happens at the source closest to the resource rather than at a distant hub (zero trust architecture).
Visibility and the kill switch
Prevention is the first line. Detection is the second, and it lives in a place the agent cannot tamper with: the network's own flow records.
Proof point: a model server talking to Tor. During live testing of a Private AI Fabric in a service provider's proof-of-concept lab, Graphiant's Data Assurance layer caught an LLM model server and its client hosts communicating with Tor, an anonymizing network built to hide where traffic comes from and where it goes. The network classified the destination as an unsecured application, scored it Critical, kept full forensic detail on every affected flow, emailed the operator's admin the moment it was flagged, and offered a one-click, enterprise-wide block. No model guardrail raised it. The network did.
That sequence is standard Data Assurance behavior, not a one-off (Data Assurance):
Classify every flow. Data Assurance sorts traffic into buckets: Graphiant Assured, Data Exchange, Enterprise SaaS, Public Internet (with a dedicated AI sub-bucket), DNS and Proxy, Unsecure DIA, Dropped, and Blocked. Unsecure DIA, meaning traffic to high-risk or unrecognized internet endpoints, is where rogue behavior shows up first.
Score the risk. The GAP Score is a 1,000-point "assurance credit score" for the enterprise. Unsecure DIA flows are its heaviest factor at 25%, and contact with public IPs carrying a threat score above 6 also counts against it.
Keep the evidence outside the agent's reach. For any flow, an operator can trace the full session path: device, site, local carrier, Graphiant entry and exit points, remote carrier, and destination. Topology history goes back up to a month or a custom window.
Cut it off. Block one application, many at once, or a whole domain category, across chosen sites and segments or the entire enterprise.
The AI Usage Dashboard adds a governance view on top: which AI platforms company data is going to, which segments and sites use them most, and which tools are unapproved "shadow AI." Each app can be approved, unapproved, or blocked from the same screen (AI Usage Dashboard).
Mapped against the five stages of a model escape, the network sees each one:
Escape stage | What the network sees | What Graphiant does |
|---|---|---|
Finds a path out | Flows from an isolated workload to an unrecognized internet endpoint | Lands them in Unsecure DIA, scores the risk, and blocks the path |
Reaches and coordinates | New destinations with first-seen timestamps; links to other agents | Rejects cross-zone traffic by default; traces each session end to end |
Divides the work | Sustained agent-to-agent traffic between segments or sites | Surfaces it in flow records and topology; zone rules deny it unless approved |
Acquires resources | Outbound reach to new compute and AI endpoints | Flags shadow AI and unapproved apps; per-zone session limits cap fan-out |
Covers its tracks | Nothing it can reach: the records live in the network, not on the host | Retains forensic detail and exports Data Assurance reports |
Where data may go, and proof of where it went
Containing an agent is also about containing its data. Graphiant controls the path traffic takes, encrypts it end to end, and returns a record of the route.
Segmentation is cryptographic, not just a tag. An Edge can only install a peer's key material if policy authorizes that pairing. So an Edge in one segment cannot reach another segment's VPN, even when the same core routers carry both.
Revocation is a network-wide kill switch. If an Edge's identity is compromised, the controller invalidates it, and a single withdrawal propagates that revocation to every peer at once. No pairwise cleanup, no waiting.
Paths are rules, not accidents. Customers can define the physical path data must take: by country, by carrier, even by last-mile provider. Graphiant enforces those constraints with segment-routing flexible algorithms. A packet bound to a "no transit through China or Russia" topology can only cross core nodes and links inside that topology, and the rule rides in the packet's own label. New sovereignty rules become new topologies, with no per-site configuration.
The core can't be turned against you. Core routers hold no session tables, no VRF tables, and no customer keys. A compromised router sees only label-switched traffic and cannot read, replay, or redirect customer data. Payloads are never decrypted in transit, only at the destination.
Encryption is quantum-resistant now. Graphiant uses ML-KEM-1024 (NIST FIPS 203, Security Level 5) in a hybrid scheme with classical ECC for key agreement, which targets "harvest now, decrypt later" attacks on captured traffic. Certificate-based authentication still uses classical cryptography; post-quantum authentication is planned for a later phase.
Every tunnel is auditable. Each installed security association is tied to an observable flow identifier. Data Assurance flags unauthorized access attempts and traffic that transits an unexpected path or jurisdiction, and exports telemetry to existing SIEM and SOC tools. That gives security teams proof of the route the data actually took.
For agent-to-agent traffic across companies, the same fabric applies per-partner zero trust access policy and DLP at the Edge, so cross-enterprise AI collaboration doesn't expose the underlying data to transit networks.
Graphiant delivers a complete Private AI Fabric designed for AI containment
Graphiant is one layer in a defense-in-depth stack, and its value comes from being the independent one. It does not replace model alignment, application guardrails, identity, endpoint protection, or the rest of an enterprise's security tooling. Those layers can all be seen, and potentially subverted, by an agent running beside them. The network sits outside that blast radius.
The flow is simple:
The AI agent sends traffic onto the network.
Graphiant enforces human-defined policy on every flow, independent of the agent.
Only approved resources and destinations are reachable.
Data Assurance watches continuously and keeps its own record.
When something goes wrong, operators contain it or cut it off, from one flow to the whole enterprise.
The Internet was built to connect machines. The network for the agentic era also has to control what autonomous machines are allowed to do.