Security isn't a feature. It's the architecture.

MAESTRO doesn't bolt security onto an AI platform. Every layer — from the filesystem to the LLM channel to the agent runtime — is designed with containment, auditability, and control as architectural requirements. Not policy. Architecture.

Rules ask an agent to behave. Containment doesn't ask.

Approach How It Works The Risk
Policy-based Rules tell agents what not to do. Agents can violate rules. A prompt injection or misconfigured agent bypasses every rule.
Monitoring-based Watch what agents do. Alert on violations. You detect the breach after it happens.
Architecturally enforced (MAESTRO) Agents work inside a contained filesystem, and MAESTRO's own web tools check every destination against a policy your administrators define. The filesystem boundary doesn't depend on the agent choosing to follow rules.

Policy-based

How It Works

Rules tell agents what not to do. Agents can violate rules.

The Risk

A prompt injection or misconfigured agent bypasses every rule.

Monitoring-based

How It Works

Watch what agents do. Alert on violations.

The Risk

You detect the breach after it happens.

Architecturally enforced (MAESTRO)

How It Works

Agents work inside a contained filesystem, and MAESTRO's own web tools check every destination against a policy your administrators define.

The Risk

The filesystem boundary doesn't depend on the agent choosing to follow rules.

This is the difference between telling someone not to open a door and removing the door.

Four Layers. Every One Governed.

1. Agent Containment (SCF)

Agents never touch the filesystem directly. MAESTRO's Secure Contextual Filesystem proxies every file operation through a sidecar-sandboxed process with per-rule jail boundaries. Symlink escape prevention. Process isolation. Extensive containment and security test coverage.

The agent thinks it has filesystem access. It doesn't. The sandbox is the enforcement.

2. LLM Channel Governance (Gateway)

MAESTRO's own agents and the workers it spawns run through the Gateway — a local proxy that listens only on this machine — and your people's Claude Code sessions can be routed through it too. Model traffic is inspected, metered, and audited before it leaves the machine, and MAESTRO's provider keys stay with the Gateway, never with the agent. Behind the Gateway, MAESTRO speaks to Anthropic, OpenAI, and Google. Every request it carries is DLP-scanned and findings are logged; MAESTRO's own session credentials are blocked outright.

The Gateway also works standalone for organizations that already have agent frameworks.

3. Audit & Observability

Every agent action produces structured audit events — file access, LLM calls, tool invocations, governance decisions. Your formal compliance trail — auth decisions, inspection verdicts, and admin operations — is retained in your tenant's row-level-security-isolated store, queryable by you; an allowlist keeps it to formal events, not verbose logs. The full event stream is emitted as structured JSON, built for your SIEM. Audit records never contain your content, only a SHA-256 correlation hash.

Format: structured JSON. Transport: query in-platform or stream to your SIEM.

4. Governed Execution

Complex multi-agent work runs through Productions with approval gates, required reviewers, stakeholder sign-off, and quality thresholds. Human oversight isn't optional. It's encoded into the work.

Your data is isolated — at the database, not just the app.

Multi-tenant systems often scope tenants in application code — a check on every query — and one missed check leaks another customer's data. MAESTRO doesn't rely on application code alone. Those checks are there, but the database enforces tenant isolation too — so even a missed check can't cross a tenant boundary.

  • Isolated to your tenant. All of it is separated from every other customer's by database row-level security.
  • Four independent layers. Isolation is enforced at four independent layers — application checks, row-level security (FORCE-enabled, covering reads and writes — even a database owner can't read around it), connection routing, and scoped transactions — so no single check is load-bearing. A gap in one is caught by the others.

The rules your AI runs under arrive through the managed-settings channel — applied above any user or project setting.

  • Centrally-managed session policy. What your AI agents can do — the system prompt, the lifecycle checks, the tools they're given — is composed by MAESTRO and delivered through Claude Code's managed-settings channel, the same mechanism enterprise IT uses to push device policy. It is applied at the highest precedence tier: no user or project setting overrides it.
  • Credentials are never injected into the agent's environment. API keys are proxied through the Gateway, or served through an encrypted, session-scoped channel that's gone when the session ends.
  • Session credentials, hardened. Session credentials are validated with constant-time comparison, with no separate secret to leak or replay.
  • Session lifetime limits and re-authentication. Sessions expire on the schedule your administrators set, and a person signs in again to continue.

Prompt Integrity — the instructions your agent runs under are governed, not borrowed from the filesystem.

An agent is only as trustworthy as the system prompt it runs under. MAESTRO owns that prompt end to end — and treats anything on the local filesystem as untrusted input, never as instructions.

  • The system-prompt bundle is owned by MAESTRO. Every component your agent runs under — its role, its policy, its skills — is assembled and delivered by MAESTRO through the managed-settings channel, applied at top precedence: no user or project setting overrides it.
  • Local memory files don't quietly flow in. MAESTRO sets Claude Code's local-memory auto-load off and re-asserts it at every session start — a user setting does not turn it back on. User-supplied filesystem context — a CLAUDE.md, local config — is treated as untrusted input, not as instructions.
  • Delivered like device policy. The prompt bundle arrives through the same managed-settings mechanism enterprise IT uses to push device policy — at a precedence above the user's settings and the agent's.
  • One more governed surface, not an open door. The prompt-assembly path is governed like every other layer — the filesystem (SCF), the LLM channel (Gateway), data isolation, and session policy — not something a local file can quietly rewrite.

A clean footprint, under IT's control.

MAESTRO is a good steward of the machine it runs on — and it slots into the controls your IT team already operates.

  • A contained, encrypted footprint. MAESTRO keeps to an encrypted vault and an ephemeral, session-encrypted workspace under ~/.maestro/ — no config files, scripts, or secrets strewn across your filesystem, and session keys stay in memory, never written to disk.
  • No plaintext API credentials on disk. Provider credentials are gateway-proxied or served through an encrypted, session-scoped channel — never written to a config file.
  • Controlled egress. MAESTRO listens only on the local loopback — nothing is exposed on the network. Outbound, it talks to named destinations your network team can allow-list: your LLM provider(s), your MaestroWorks tenant and its sign-in service, MAESTRO's update storage, the web-search and media providers a role is permitted to use, and your SIEM if you turn on forwarding. Agent web access through MAESTRO's own tools is governed by policy: administrators define named site sets and company-wide rules, start in observe mode to see what agents reach for, then switch to blocking — and a blocked request comes back as a readable refusal naming the policy that refused it, never a network error.
  • Contained by projection. Session policy arrives through the managed-settings channel, above any user or project setting; the agent sees a contained SCF projection, not raw filesystem access.
  • Signed and notarized. The binary is Apple-signed and notarized, so it installs clean.

Compliance-Ready

MAESTRO doesn't claim compliance certifications. We produce the architectural evidence and audit data that supports your compliance posture.

EU AI Act Agent containment evidence, human oversight gates, audit trails, transparency records
HIPAA DLP screening, tenant isolation, configurable LLM routing, access audit events
SOC 2 Type II Audit trail, access controls, change management
GDPR Tenant data isolation, access audit events, suspension and offboarding.

The EU AI Act is phasing in now — its transparency obligations have applied since August 2026, with further obligations following on the Act's published schedule. Organizations deploying AI agents need governance infrastructure that is already producing evidence — not one they start building when the auditors arrive.

Your AI, governed.

You've seen the architecture. If this is the kind of foundation you need under your AI, sign up for early access.