Enterprise AI Needs a Captain’s Bridge, Not Another Filter

That is the shape of the AI risk security teams now have to manage, and it is not the shape prompt filters were built for. AWS Bedrock Guardrails and Azure AI Foundry guardrails are filters: each judges a single prompt or response on its way to its own cloud’s models and returns a verdict. Netzilo is built as a bridge, an end-to-end detection and response platform for AI agents. A ship’s bridge sees the whole ship, understands how its parts relate, and can act on any of them.

The argument has three parts. The risk has moved from what models say to what agents do. A filter on one pipe cannot follow it. And a bridge has to do three things: see everything, connect the steps, and act on what it finds.

The risk moved from what models say to what agents do

A chatbot only talks. An agent acts: it calls tools and MCP servers, reads and writes files, starts processes and opens network connections. Everything it does falls on one of three surfaces.

• Prompts. What the agent and its model say to each other, including files and answers.
• Tool use. The tools, MCP servers and APIs the agent calls, and what they send back.
• The machine. The processes it starts, the files it reads and writes, and the connections it opens.

Attackers use all three. A poisoned tool response steers the agent before any model reads it. A credential file read never becomes a prompt. And the steps that matter are rarely suspicious one at a time: they become an attack only in sequence. Defending agents means watching the whole chain, not only the conversation.

A filter on one pipe cannot see an attack in sequence

Bedrock Guardrails and Foundry guardrails are good at what they were built for: classifying content sent to and from their own models. Measured against agents, they share three structural limits.

1. One surface. They judge prompts and responses. Bedrock Guardrails do not evaluate tool definitions, tool-call arguments or tool results (AWS documentation). Foundry’s tool checks are in preview and cover a fixed list of tools that does not include MCP (Microsoft documentation).
2. One request at a time. Each prompt is judged on its own. AWS comes closest: AgentCore session policies can recall earlier tool calls, but only those made through AgentCore Gateway. Microsoft’s nearest feature, Task Adherence (preview), checks an agent’s tool actions against the user’s intent, one request at a time.
3. One verdict. The answer is allow, block or mask the request. Neither vendor documents a guardrail that inspects or isolates an agent session. Microsoft Defender can isolate a whole device or disable a user, which stops everything on it, not only the agent.

Each limit has a counterpart in what a bridge must do: see everything, connect the steps, and act on what it finds.

Step 1: See everything

The first job of a bridge is to leave nothing in the dark. Netzilo watches every AI session in the enterprise from one platform and one console.

Coverage has three dimensions.

• Every agent type. Homegrown agents your teams build, general-purpose agents people install (Claude Code, Cursor, desktop assistants), and SaaS agents that live in web pages (ChatGPT, Gemini).
• Every surface. Prompts, tool and MCP traffic, and process, file and network activity, each checked where it happens: a tool response as it reaches the agent, a tool call before it runs, a file read as the agent causes it.
• Every platform. Laptops, servers, browsers and the AI Gateway, in front of any model provider, Bedrock and Azure OpenAI included. One rule language works everywhere, so changing provider changes no guardrail.

Cloud guardrails cover the cells next to their own models. The rest is partial, in preview, or sold as separate products.

The tool surface is where that gap costs most. Netzilo judges each MCP tool result as it reaches the agent, before any model sees it, and redacts what should not pass.

Step 2: Connect the steps

Seeing is not enough. The steps that make an attack are individually ordinary, so a guardrail has to read them as one chain. A Netzilo guardrail is a program, not a pattern. It keeps state across the whole agent session, correlates prompts, tool calls, processes, files and connections, and can call an AI judge when a decision needs one.

Take the scenario from the start.

The agent downloads a skill from an unfamiliar host, then asks for cloud credentials. The credential request is routine on its own, and the download never reaches a model. Netzilo’s behavior monitor records the download against the session, so a guardrail on the credential call can see it and refuse.

This is not hypothetical. Netzilo’s Claw Chain guardrail catches the same shape on real telemetry: an untrusted fetch, a shell trick that hides the command, a credential read, then a connection to the cloud metadata endpoint. Every step is a process, a file read or a connection, and none is a prompt.

The result is not a verdict on one request but a kill chain: the evidence of every step that led to the decision, ready for the security team to review.

Step 3: Act on what you find

Detection that waits for a person is too slow for an agent that acts in seconds. Netzilo guardrails respond on their own, and they do it as a team: they share one record of each session, so one guardrail’s finding changes what the next one does.

Cruise Control is the simplest example: four guardrails, one escalation.

1. Watch. Gate checks tool calls before they run and judges the risky ones against what the user asked for. Patrol follows the whole session in the background. When it finds drift, injected instructions or likely harm, it puts the session under watch, and Gate then judges every action that is not a read.
2. Inspect. Inspection marks the session Under Inspection on every device, browser and gateway that carries it.
3. Isolate. If Gate blocks another action, Containment isolates the session. All of its AI activity stops everywhere, with no one watching.

The same actions are available by hand. The AI Kill Switch stops all AI activity of an agent, a device, a user, a group or the whole account in one action. Isolation reaches devices in under a second, AI Gateways in about 2 seconds and browsers in about 30 seconds, and it holds through restarts and while the Netzilo Server is unreachable.

Teams need not be elaborate. Each of these is two short guardrails: one notes a finding in the session record, and the other acts on it.

The last team is an example in Netzilo’s documentation. The others are patterns anyone can build with the same engine.

The test to apply to any AI guardrail

The argument reduces to six questions. They work on any vendor, Netzilo included.

The bottom line