Security

Intutic is a governance layer that sits between your AI agents and LLM providers. Security is foundational — every design decision prioritizes the principle that governance infrastructure must never become the attack surface it's meant to protect.

Threat Model

Intutic defends against three categories of threat:

Threat	Vector	Mitigation
Agent misuse	AI agent executes destructive tool calls (file deletion, credential exposure, unauthorized API calls)	Real-time SOP evaluation with BYPASS/ENHANCE/HIJACK/KILL verdicts via the circuit breaker
Credential leakage	API keys, tokens, or secrets exfiltrated through agent output or prompt injection	DLP scanning in the proxy hot path; secrets detected and redacted before reaching the LLM
Unauthorized access	Rogue agents or developers bypassing governance controls	Harness config drift detection with auto-revert, immutable local SOP rules, and local daily spend caps
Uncontrolled egress	An agent (or a compromised dependency it pulls in) reaches the network by a path other than the governing proxy, so nothing above ever inspects the traffic	Proxy-level allow-list enforcement (`intutic_settings.egress.mode`), and — closing the gap where an agent simply doesn't route through the proxy at all — `intutic enforce`'s host-level default-deny firewall. See Network Egress Control

Data Flow

Intutic runs in one of two modes, and they differ in exactly one respect: whether anything leaves your machine.

Standalone (open-core default)

Developer → AI Agent → Intutic Proxy (:4000) → LLM Provider
                            │
                      ┌─────▼──────┐
                      │  Policy    │
                      │  Engine    │
                      │  (WASM +   │
                      │   SOPs)    │
                      └────────────┘
                       (nothing leaves
                        this machine)

Every LLM request from an AI agent is routed through the local Intutic proxy on port 4000
The proxy evaluates tool calls against SOPs in the WASM policy engine (sandboxed, with an enforced 5 ms wasmtime timeout)
Verdicts and telemetry stay on the local machine. Bandit routing state is written to your own Valkey; nothing is transmitted to Intutic or anyone else
The proxy never stores prompts or completions — only structured telemetry (tool names, verdicts, token counts, timing)

This is what you get by default. Open core ships no control plane, and with policy.control_plane_url unset the policy pre-check is skipped entirely.

Data Locality

The proxy runs locally on the developer's machine. LLM traffic is never rerouted anywhere — it flows directly from the proxy to the LLM provider.

Nothing leaves the machine: no telemetry, no verdicts, no traces. Prompts and completions are never transmitted anywhere by the proxy.

Encryption

In Transit

All network communication is encrypted with TLS 1.2+:

Path	Protocol
Proxy → LLM Provider	HTTPS (TLS 1.2+)

At Rest

Data	Storage	Encryption
Session state & caches	Valkey (Redis-compatible)	Ephemeral — not persisted to disk
Bandit learning	`~/.intutic/bandit-state.json`	File permissions inherited from `~/.intutic`
Local config & credentials	`~/.intutic/credentials.json`	File permissions (`0600`) + system keychain
Provider credentials in flight	Process memory only	Never written to disk

Enforcement Coverage

Connected harnesses are scored on a four-tier system:

Tier	Enforcement Level
A	Strict — immutable rules, credential redaction, system command blocking
B	Moderate — prompts for suspicious tool combinations
C	Audit — records traces without blocking
D	Observe — alerts only, fail-open

Responsible Disclosure

If you discover a security vulnerability, please report it to support@intutic.ai. We aim to acknowledge reports within 24 hours and provide a fix or mitigation within 7 business days.

Page	What it covers
Getting Started	Quickstart guide, local CLI setup, and harness connection
How It Works	Full architecture walkthrough — proxy, policy engine, control plane
Governance Controls Checklist	A control-by-control mapping against a standard enterprise evaluation checklist
Custom Filters (WASM)	WASM policy rules engine for custom tool-call filtering
CLI Reference	CLI commands, doctor diagnostic tool, and local configuration
Integrations Hub	Harness setup guides for 39 supported agent tools

Security ​

Threat Model ​

Data Flow ​

Standalone (open-core default) ​

Data Locality ​

Encryption ​

In Transit ​

At Rest ​

Enforcement Coverage ​

Responsible Disclosure ​