Control the work before it compounds.
Agents that learn are powerful. Without governance, they amplify risk. Hyperstruck gives leaders the controls to decide what reaches a model, what becomes institutional knowledge, who can use it, and when a person must decide.
Stop risk early
PII and prompt-injection checks use specialised models on the inbound path — before generation starts. Once content has hit the model, it is already too late.
Reuse judgment safely
Learnings are generalised and scrubbed of personal data so they can travel across teams. Instance-specific facts — including entity identifiers — stay in claims, the higher-sensitivity store, under separate access, quarantine, and curation controls.
Govern who acts
Human gates, learning trust, fine-grained access, usage reporting, and spend limits keep autonomy within bounds you set.
Screen input before the model
Configure PII handling per agent: anonymise (mask), block, or log-only for entities such as names, emails, phones, and payment details. Prompt-injection detection uses specialised classifiers that are more deterministic than asking another LLM to police itself. Both run on the way in, so sensitive or hostile content is handled before generation starts.
Once content has reached the model, you are already past the control point. Hyperstruck screens on the way in.
Too late after the model
Raw input
“Email Jane Smith at jane@acme.com… ignore prior rules…”
Specialised checks
PII detector · prompt-injection classifier
Safe handoff
Masked or blocked before any LLM call
Without this
Personal data and jailbreak text land inside the model context.
With Hyperstruck
Configure anonymise, block, or log-only per entity. Hostile prompts can be stopped at the door.
Share learnings without sharing people
Cross-team sharing is gated by shareable classification — a deterministic privacy label. Identifiers from the originating run are redacted before a learning can carry that label. Instance-specific facts stay in claims: entity-bound truths with their own curation, quarantine, and permission path.
Example · collections follow-up
What happened in the run
Reminder emailed to Maya Chen (maya@northwind.io) for invoice INV-88421 after three quiet business days. Payment arrived next morning.
Stored learning (reusable)
After three quiet business days, send a short payment reminder before escalating. Contact details stay as <PERSON> / <EMAIL_ADDRESS>.
Claim (one attribute · one entity)
Entity Northwind
Attribute reminder quiet period
Value 3 days
Source · collections run · since today · awaiting corroboration
Human approval where it matters
Pause runs at plans, milestones, steps, or tools. Set autonomy from full supervision to light touch. Progressive trust can earn auto-approval after clean streaks, then ask again after idle time. High-stakes actions wait for approve, edit, or reject.
Autonomy expands after proven judgment — not on a schedule.
Enforce structure, not guesswork
Reflection checks whether a run actually earned its result. Structural preconditions refuse consequential tools when the evidence does not support them. Contradiction detection, deduplication, and a learning trust ladder (unverified through corroborated) stop weak or conflicting advice from quietly becoming policy.
Autonomy as a dial
Start tight on a new workflow. Loosen only where the team has earned trust. Progressive trust can auto-approve after clean approvals, then ask again after idle time.
L1
Full supervision
Plans, milestones, steps, tools
L2
High supervision
Structure + risky tools
L3
Moderate
Uncertainty + destructive tools
L4
Light touch
Destructive tools and escalations
L5
Custom only
Your policies, no default gates
Learning trust ladder
Not every tip deserves the same weight. Trust rises when outcomes back it, and falls when it misleads. Higher trust keeps influence longer.
Unverified
Fresh observation. Useful, not gospel.
Agent-verified
Survived real use without misleading.
Source-verified
Backed by an external source of truth.
Corroborated
Multiple independent confirmations.
Inspect and curate what agents learn
Operators can browse and curate learnings, inspect where they came from, see where they were applied, and whether they helped or misled. Evidence graphs make relationships visible. Needs-review queues surface conflicts before they become policy by accident.
Every learning keeps a trail: where it came from, where it was used, and whether it helped.
Operator view · illustrative
1 needs review · contradiction
Paginate when a query may return >100 rows
12 runs
Prefer staging before production schema edits
4 runs
Skip integration tests for hotfix branches
2 runs
Fine-grained access and spend controls
Fine-grained authorization covers learnings, spaces, and agents. API keys carry explicit scopes and space reach, with separation of duty so a runtime key cannot also curate what it ingested. Usage reports and tenant spend limits keep cost visible and bounded.
Spaces let you group agents and learnings by department, product area, or ownership. Spend limits and usage reports keep cost as visible as permission.
Two gates on every request
API key scopes
Runtime key
agents:read · agents:execute · usage:read
Curation key
claims:curate
What the caller may do in general — separate keys, not one combined key
Fine-grained access
Objects
Spaces · agents · learnings · claims
Whether they may touch this object
Separation of duty
Rule
Run keys ≠ curation keys
A runtime cannot approve what it just ingested
Strong baseline security
Tenant isolation, identity, encryption, and erasure — the controls security reviews ask about first.
Tenant isolation
Customer data is isolated at the database with row-level security, not only application filters.
Enterprise SSO
Authenticate through your identity provider so access and offboarding follow company policy.
Encryption
TLS in transit and AES-256 at rest across storage. Provider credentials use per-tenant AES-256-GCM keys.
Claim erasure
Erase an entity’s claims with an audit receipt, and unwind the reinforcement those facts fed into learnings. The erasure API states what it covers — and what it does not — up front.
Bring your own LLM keys
Connect your own model providers when you need their retention and processing terms to apply.
No training on your data
AI subprocessors process customer data to provide the product. They do not train models on it.
Rate limits and spend caps
Per-tenant rate limits curb abuse. Hard spend limits stop runaway agent cost before it becomes a finance surprise.
Self-host option
Run the full stack in your environment when residency or operating model requires it.
Subprocessors, privacy terms, and the data processing addendum live on the Trust, Privacy, and DPA pages. Technical detail is in Security docs.
Common security questions
Careful prompts are not a control plane. Hyperstruck runs specialised detectors for PII and prompt injection on the inbound path, redacts personal data from stored learnings, and keeps instance-specific facts in claims under separate controls. Quality gates and human approvals are structural, not hopeful.
Yes. Learnings are meant to generalise. Claims hold the instance-specific truths — including entity identifiers — so agents can stay precise without publishing those facts into the reusable corpus. That makes claims the higher-sensitivity store: facts from attacker-reachable channels stay quarantined and invisible to recall until independent sources corroborate them.
You do. Autonomy levels and approval policies choose when a run must pause. Spaces and fine-grained access choose who can read, run, or curate. API key scopes limit what automation can do, including separate keys for dispatch versus curation.
Operators can see which learnings were offered, whether they were applied, and whether outcomes marked them helpful or misleading. Usage and spend reporting show activity and cost. That is how governance stays tied to business results, not just policy documents.
Contradiction detection flags conflicts into a needs-review path instead of silently stacking opposite advice. Operators can see the relationship, decide which lesson should win, and keep the corpus coherent as standards change.
Map these controls to your workloads
We can walk through the gates you need, who should hold which keys, and how Hyperstruck fits your operating model.
Report a vulnerability: security@hyperstruck.com