Agent Controls
Beyond Which Tool, to How It Behaves
Discovery tells you which AI tools are in use. Agent controls go a level deeper, to how those agents behave. AI agents do things a human user would not, so the risky behaviors worth watching are different from what an EDR is designed to catch.
Cerbera AI surfaces this through Agent Activity: a log of tool invocations, risk-graded per call, alongside the alerts these signals raise. This is how you answer "who is using personal accounts on Claude Code?" or "which agent just tried to open a remote shell?"
Personal Account Usage
One of the most common findings is the use of non-enterprise accounts, on Claude Code, on ChatGPT, and elsewhere. People reach for their personal account because it is the path of least resistance, and it creates real problems:
- No offboarding control. When the employee leaves, there is no way to delete the company data in those personal cloud sessions or be sure access is revoked.
- No policy reach. You cannot apply the security settings you have configured org-wide to an account you do not administer.
Cerbera AI includes a license check you can add to a rule to flag personal account usage on supported providers, so you can require enterprise accounts instead.
Risky Command and File Access
Every tool invocation an agent makes is graded for risk based on the command it runs or the file it touches:
| Signal | Why it matters |
|---|---|
Remote-access commands (ssh, scp, sftp, and similar) | An agent opening a remote shell or copying files off-device is rarely intended and is high risk. |
Credential file access (SSH keys, .netrc, PKCS#12 files, and other files that typically hold secrets) | These files hold credentials the agent should not need to read in the course of normal work. |
| Agent running with approvals disabled ("YOLO mode") | Some coding agents (for example Codex CLI) can run in a mode that skips confirmation before taking an action. Cerbera flags this posture so you know when it is in use. |
These show up as high or critical risk entries in Agent Activity, and you can turn any of them into a rule.
Not every sensitive-looking path is flagged. Files like .env are deliberately excluded from credential-file detection: they are so commonly checked into repositories as templates, or contain no real secrets, that flagging them produces far more noise than signal. Redaction (see Rules) is the right tool for catching an actual secret in a request body, regardless of which file it came from.
An EDR is designed around human usage and may not stop an agent from connecting to, say, a managed Postgres instance over SSH. With Cerbera AI you can define rules for exactly these agent behaviors and ensure usage stays reasonable.
Supply Chain (Roadmap)
Coding agents change the supply-chain picture. Claude Code and similar tools constantly pull open-source packages to run just-in-time scripts. Those packages never pass through a CI/CD pipeline, so there is no filter on them.
Cerbera is exploring analysis of this pattern: when an agent downloads many packages for a one-off script, checking whether those packages carry known vulnerabilities. This is on the roadmap rather than available today.
Agent controls are expressed as rules. Start them in monitor mode, confirm the behavior is what you think it is, then promote to block.