Overview

INFO

Access to Jozu Agent Guard is available by invitation. Please contact [email protected] for more information.

Agent Guard is a secure runtime for AI coding agents. It is built on a MicroVM or Kata Container inside which the agent is executed. You define what your agent can and cannot do, and Agent Guard enforces those rules at the operating system level. Enforcement does not depend on prompts ("check with me before deleting anything") because agents can ignore prompts. Agent Guard sits between the agent and the things it wants to do. Every tool, communication, and network access call goes through a policy check before it executes.

How it works

The agent runs inside a disposable Linux microVM that only sees the workspace you share with it. It has no access to your home directory, SSH keys, or credentials unless you explicitly pass them. Policies run inside the microVM. When the agent exits, the microVM is thrown away.

Agent Guard works with Claude Code, Gemini CLI, Codex CLI, and OpenClaw.

Where Agent Guard fits with Jozu Hub

Jozu has two products. Agent Guard is the runtime; Jozu Hub is the registry where signed policies, agent definitions, and audit logs are stored. Agent Guard pulls from Hub and enforces those policies at the OS level.

Agent Guard works without Hub. Local policy files in ~/.agentguard/policies/ are enough for solo use. Hub adds three things on top of that: sharing policies across machines, verifying that policies were not tampered with in transit, and centralizing audit logs from multiple environments.

The public Hub at jozu.ml is free and works well for individual use. Organizations needing shared orgs, customized scans, custom deployment artifacts, or larger storage need a private Hub. See Where Agent Guard fits in Jozu for the full Hub story.

What Agent Guard does not do

Agent Guard is part of a layered security model so it works alongside:

• Network intrusion detection: A network intrusion detection system can run alongside Agent Guard without conflict.
• Transport security between agents: Agent Guard does not implement mTLS or any agent-to-agent authentication. Those belong at the network layer.
• Model behavior monitoring: Agent Guard does not track inference quality, drift, output distribution, or any other model performance signal. Pair it with an observability tool if you need that.

Requirements

macOS on Apple Silicon (M1 or later). The agent itself runs inside a Linux ARM64 microVM that ships with Agent Guard. Linux and Windows host support is on the roadmap.

What these docs cover

Quickstart gets you running in about five minutes. Beyond that:

• Running agents: per-agent setup for Claude Code, Gemini, Codex, and OpenClaw.
• Policies: write your own, use pre-built tiers, manage the policy lifecycle.
• Agent definitions: pull a complete agent configuration from a registry in one command.
• How Agent Guard works: architecture, threat model.
• Operations: logs and audit, monitoring, deploying across a team.
• Reference: every CLI command, every policy field, every config setting.