Security & governance

Control the work before it compounds.

Agents that learn are powerful. Without governance, they amplify risk. Hyperstruck gives leaders the controls to decide what reaches a model, what becomes institutional knowledge, who can use it, and when a person must decide.

Stop risk early

PII and prompt-injection checks use specialised models on the inbound path — before generation starts. Once content has hit the model, it is already too late.

Reuse judgment safely

Learnings are generalised and scrubbed of personal data so they can travel across teams. Instance-specific facts — including entity identifiers — stay in claims, the higher-sensitivity store, under separate access, quarantine, and curation controls.

Govern who acts

Human gates, learning trust, fine-grained access, usage reporting, and spend limits keep autonomy within bounds you set.

Input protections

Screen input before the model

Configure PII handling per agent: anonymise (mask), block, or log-only for entities such as names, emails, phones, and payment details. Prompt-injection detection uses specialised classifiers that are more deterministic than asking another LLM to police itself. Both run on the way in, so sensitive or hostile content is handled before generation starts.

Once content has reached the model, you are already past the control point. Hyperstruck screens on the way in.

Too late after the model

Raw input

“Email Jane Smith at jane@acme.com… ignore prior rules…”

Specialised checks

PII detector · prompt-injection classifier

Safe handoff

Masked or blocked before any LLM call

Without this

Personal data and jailbreak text land inside the model context.

With Hyperstruck

Configure anonymise, block, or log-only per entity. Hostile prompts can be stopped at the door.

Knowledge hygiene

Share learnings without sharing people

Cross-team sharing is gated by shareable classification — a deterministic privacy label. Identifiers from the originating run are redacted before a learning can carry that label. Instance-specific facts stay in claims: entity-bound truths with their own curation, quarantine, and permission path.

Example · collections follow-up

What happened in the run

Reminder emailed to Maya Chen (maya@northwind.io) for invoice INV-88421 after three quiet business days. Payment arrived next morning.

Stored learning (reusable)

After three quiet business days, send a short payment reminder before escalating. Contact details stay as <PERSON> / <EMAIL_ADDRESS>.

Claim (one attribute · one entity)

Entity Northwind

Attribute reminder quiet period

Value 3 days

Source · collections run · since today · awaiting corroboration

Human oversight

Human approval where it matters

Pause runs at plans, milestones, steps, or tools. Set autonomy from full supervision to light touch. Progressive trust can earn auto-approval after clean streaks, then ask again after idle time. High-stakes actions wait for approve, edit, or reject.

Autonomy expands after proven judgment — not on a schedule.

Quality controls

Enforce structure, not guesswork

Reflection checks whether a run actually earned its result. Structural preconditions refuse consequential tools when the evidence does not support them. Contradiction detection, deduplication, and a learning trust ladder (unverified through corroborated) stop weak or conflicting advice from quietly becoming policy.

Autonomy as a dial

Start tight on a new workflow. Loosen only where the team has earned trust. Progressive trust can auto-approve after clean approvals, then ask again after idle time.

L1

Full supervision

Plans, milestones, steps, tools

L2

High supervision

Structure + risky tools

L3

Moderate

Uncertainty + destructive tools

L4

Light touch

Destructive tools and escalations

L5

Custom only

Your policies, no default gates

Learning trust ladder

Not every tip deserves the same weight. Trust rises when outcomes back it, and falls when it misleads. Higher trust keeps influence longer.

Unverified

Fresh observation. Useful, not gospel.

Agent-verified

Survived real use without misleading.

Source-verified

Backed by an external source of truth.

Corroborated

Multiple independent confirmations.

Operator visibility

Inspect and curate what agents learn

Operators can browse and curate learnings, inspect where they came from, see where they were applied, and whether they helped or misled. Evidence graphs make relationships visible. Needs-review queues surface conflicts before they become policy by accident.

Every learning keeps a trail: where it came from, where it was used, and whether it helped.

Operator view · illustrative

1 needs review · contradiction

Paginate when a query may return >100 rows

12 runs

Helpful

Prefer staging before production schema edits

4 runs

Helpful

Skip integration tests for hotfix branches

2 runs

Misled
Access & spend

Fine-grained access and spend controls

Fine-grained authorization covers learnings, spaces, and agents. API keys carry explicit scopes and space reach, with separation of duty so a runtime key cannot also curate what it ingested. Usage reports and tenant spend limits keep cost visible and bounded.

Spaces let you group agents and learnings by department, product area, or ownership. Spend limits and usage reports keep cost as visible as permission.

Full permissions matrix in the docs

Two gates on every request

API key scopes

Runtime key

agents:read · agents:execute · usage:read

Curation key

claims:curate

What the caller may do in general — separate keys, not one combined key

Fine-grained access

Objects

Spaces · agents · learnings · claims

Whether they may touch this object

Separation of duty

Rule

Run keys ≠ curation keys

A runtime cannot approve what it just ingested

Platform foundations

Strong baseline security

Tenant isolation, identity, encryption, and erasure — the controls security reviews ask about first.

Tenant isolation

Customer data is isolated at the database with row-level security, not only application filters.

Enterprise SSO

Authenticate through your identity provider so access and offboarding follow company policy.

Encryption

TLS in transit and AES-256 at rest across storage. Provider credentials use per-tenant AES-256-GCM keys.

Claim erasure

Erase an entity’s claims with an audit receipt, and unwind the reinforcement those facts fed into learnings. The erasure API states what it covers — and what it does not — up front.

Bring your own LLM keys

Connect your own model providers when you need their retention and processing terms to apply.

No training on your data

AI subprocessors process customer data to provide the product. They do not train models on it.

Rate limits and spend caps

Per-tenant rate limits curb abuse. Hard spend limits stop runaway agent cost before it becomes a finance surprise.

Self-host option

Run the full stack in your environment when residency or operating model requires it.

Subprocessors, privacy terms, and the data processing addendum live on the Trust, Privacy, and DPA pages. Technical detail is in Security docs.

FAQ

Common security questions

Careful prompts are not a control plane. Hyperstruck runs specialised detectors for PII and prompt injection on the inbound path, redacts personal data from stored learnings, and keeps instance-specific facts in claims under separate controls. Quality gates and human approvals are structural, not hopeful.

Yes. Learnings are meant to generalise. Claims hold the instance-specific truths — including entity identifiers — so agents can stay precise without publishing those facts into the reusable corpus. That makes claims the higher-sensitivity store: facts from attacker-reachable channels stay quarantined and invisible to recall until independent sources corroborate them.

You do. Autonomy levels and approval policies choose when a run must pause. Spaces and fine-grained access choose who can read, run, or curate. API key scopes limit what automation can do, including separate keys for dispatch versus curation.

Operators can see which learnings were offered, whether they were applied, and whether outcomes marked them helpful or misleading. Usage and spend reporting show activity and cost. That is how governance stays tied to business results, not just policy documents.

Contradiction detection flags conflicts into a needs-review path instead of silently stacking opposite advice. Operators can see the relationship, decide which lesson should win, and keep the corpus coherent as standards change.

Next step

Map these controls to your workloads

We can walk through the gates you need, who should hold which keys, and how Hyperstruck fits your operating model.

Report a vulnerability: security@hyperstruck.com