Traditional firewalls filter packets. Identity systems verify principals. Sevorix filters actions. It sits between your agent and the system it's operating on, evaluating every shell command, outbound request, and syscall against your policy before execution. If an agent attempts a destructive or unauthorised action — from a bad inference or a successful jailbreak — the call fails at the OS, not at a prompt.

Three paths. In-kernel blocks resolve at Ring-0 with no round trip. Cache hits — a SHA-256 match against the local semantic cache — return in nanoseconds. Only a cache miss escalates to concurrent multi-model evaluation, inside a sub-50ms end-to-end budget. Allowed traffic on a known pattern adds no measurable overhead.

Different layers, and you probably want both. An MCP server or L7 gateway governs the tool calls your agent declares — structured, well-formed, visible at the application layer. Sevorix governs what actually executes. If an agent is injected into dropping to a raw shell or opening a socket directly, it never touches the gateway; Sevorix still sees the execve or connect. The gateway is policy. We're enforcement.

Sevorix enforces at the host level, so it's framework-agnostic — it sees what the process does, not what the framework intended, and works the same for raw Python as for any orchestration library. It requires the agent to run inside a supervised process tree. On Kubernetes that's automatic: a mutating admission webhook injects the interception layer into targeted pods with no application changes. On laptops and enclaves the agent launches through our shim. We ship a first-class integration for Claude Code today, with Codex and OpenClaw in development.

Depends on the tier, and we'll be precise. Lite runs entirely on your machine — no account, no telemetry. Pro enforces locally and syncs event metadata to your Watchtower dashboard, 7-day retention. Enterprise is self-hosted or air-gapped; enforcement and storage both stay inside your boundary. Centralised policy sync, the shared audit ledger, and fleet-wide STEER live on Enterprise where you deploy them. In every tier, before anything is escalated for evaluation, zero-copy tokenization scrubs PII locally — sensitive values are swapped for sterile tokens and never leave your VPC. Enforcement decisions are always made locally; no action waits on a network call to us.

You cannot prompt-inject a Linux kernel firewall. No runtime layer stops injection — it happens in the context window, before an action exists to intercept. What Sevorix changes is the blast radius. Assume the injection succeeds. Assume the model is fully compromised and doing exactly what an attacker wants. It still has to make a syscall to do damage, and that syscall meets a policy written by you, not by the model. We don't secure the prompt. We make it survivable.

Two layers, two jobs. The kernel layer is deterministic and unconditional. It doesn't reason, it doesn't score, it enforces. If a rule says deny, the syscall fails — every time, regardless of what the model believes it's doing. Above it, Jury of Rivals handles the cases policy can't express as a pattern: three heterogeneous models, adversarial personas, concurrent evaluation, majority required to block. It is probabilistic, and the architecture treats it that way — it can only narrow what the deterministic floor already permits, never widen it. A hung jury doesn't open a door.

It degrades before it blocks, and it never opens.
‍
Startwith what isn't affected. Your deterministic policies live in compiled eBPFmaps on the node. They don't call out, they don't wait on anything, and they have no network dependency — a total loss of connectivity to Sevorix changes nothing about whether a denied syscall is denied on your box. On Lite and Pro that is the decision path: there's no external evaluation to fail.
‍
Escalation exists on Enterprise, where actions your policy can't express as a pattern go to Jury of Rivals. That path degrades in stages: connectivity loss has no effect on kernel enforcement; a slow or erroring cloud jury trips the circuit breaker and reroutes over a local UNIX socket to the on-node SLM jury; if thelocal jury is unavailable or not deployed, the terminal case is block. The absence of a verdict is never counted as approval.

What never happens is fail-open. There is no timeout, outage, or degraded mode in which an action we could not evaluate is allowed through. Security over uptime is the constraint the system is built around; the failover path exists so that constraint costs as little availability as possible — not so it can be relaxed.

Every Block, Steer, and Flag event records the agent identity, the intercepted action, the matching policy, the verdict, and a timestamp — structured, exportable audit records for the chain of custody your HIPAA, ISO 42001, and EU AI Act auditors will ask for.

Yes — and you don't have to start there. Policies are JSON or YAML: substring, regex, or an external checker binary, scoped to shell, network, or syscall context and grouped into roles. Rules hot-reload without restarting agents. For enterprise, Watchtower ingests your existing compliance documents and compiles them into deterministic constraints, then signs the compiled policy with your enterprise private key before it's pushed to the fleet. The local daemon verifies that signature against a pinned public key before it touches the eBPF maps — invalid, missing, or altered in transit, the update is dropped and the fleet alerts.