Information barriers for AI agents

MahaGuardian gives every AI agent in your practice a credential that opens exactly one engagement — and nothing else. The barrier is in the credential, not in the prompt.

Get in touch Read the partner brief

Patent pending · Open source · Dual licensed

Your AI agent can reach every client file your staff member can reach. An agent working on one engagement can read — and incorporate — data from any other engagement the same person has access to.

The firm finds out when the other client does. MahaGuardian closes this gap at the credential layer, before the content can reach the draft.

Three properties your compliance officer will recognise

Matter walls built into credentials

Every agent carries a credential that opens exactly one engagement's information. There is no key on that credential for any other engagement. The agent is not asked to be careful — it holds a key that does not open other matters through the Guardian-controlled boundary.

Tamper-evident audit trail

Every retrieval the agent performs through MahaGuardian is recorded in a hash-chained log on your firm's infrastructure. Each agent operates under its own identity, distinct from the staff member's, so the agent's actions never blur into the staff member's own activity.

Human approval for sensitive actions

For actions your firm has flagged as sensitive — external communications, sharing privileged material, accessing information above an agent's normal scope — the agent must request approval from a named human before proceeding. The request and the approval are both recorded.

Works alongside your existing controls

MahaGuardian sits alongside Microsoft, Okta, iManage, and the rest of your security infrastructure — not instead of them. It decides whether an agent credential comes into existence and can destroy it; your platform decides what that credential can do once it exists.

Guardian authority records and your platform's own activity logs can be reconciled, so a credential issued without firm authority is detectable by the firm itself. The signing keys never leave your infrastructure.

MahaGuardian works with most AI agents that interact with your systems through standard APIs — OpenAI, Anthropic, Google, self-hosted models. If your firm switches vendors next year, you do not re-architect your information barriers.

Scope. MahaGuardian's credential authority applies to agents whose credential path the firm controls — typically firm-built agents with their own application registration. Microsoft-operated agents (Copilot Studio declarative agents, SharePoint agents, first-party Copilot) authenticate through Microsoft's own service principals; platform-level controls apply to those agents directly.