Enclave · Companion to Developer Edition · Apache-2.0
Run an agent in a box it can’t talk its way out of.
Watchlight AI Enclave runs your agent in a sandbox whose only route out is an egress guard, and seals what the agent was allowed to do and what it tried to reach into one signed evidence bundle.
Hand that bundle to your security review. They can check it offline, without an account, and without trusting you or us.
pip install watchlight-enclave
$ pip instal
Two questions every security review asks
You hand an agent a repository and a task. It can edit files, call tools, and reach the network. Then someone asks what did it actually try to reach? and what was it allowed to do, and who decided? Neither can be answered by reading logs the agent could have written. Enclave answers both, from records the agent does not control.
Two independent witnesses, one record
Developer Edition knows the agent asked to wire money. The egress guard knows it tried to reach a host that was not on the list. Neither fact gives you the other, and the bundle holds both in one ordered chain.
The sandbox decides where the agent may connect
- A non-root process, a read-only root filesystem, every capability dropped, no new privileges
- An internal network with no route out except the egress guard
- The guard allows only the hosts you list, and refuses private ranges, link-local addresses, and the cloud metadata endpoint
- It writes each connection attempt down before forwarding it. If it cannot write, it refuses
Developer Edition decides what the agent may do
- Which tools, on which resources, under whose policy
- Standard Cedar policy, so the rules are readable and every decision is deterministic
- The engine runs inside the agent, so every decision is recorded and none are sampled away
- The same policy file feeds both layers, and its hash goes into the evidence
Evidence that never understates what happened
Each record is hashed over the one before it, and the bundle is sealed with a key you generate and keep. It records what got through as well as what was blocked: the host, the port, and the bytes each way. Verification gives one of four answers, so “this file is lying” and “this file is honest about a gap” never look the same.
- okThe chain is intact, isolation held, nothing is missing. The only answer that exits cleanly.
- incompleteEverything in the bundle is true, and it says what might be missing.
- uncontainedThe chain is fine, but isolation slipped. Trust the record and go deal with it.
- failedThe chain is broken. Do not trust the file.
$ wl-enclave verify runs/<id>/bundle --signer sha256:64b0…7d
wl-enclave: records 11
wl-enclave: egress attested: the guard was the sandbox's only route
wl-enclave: controls 11/11 in force
wl-enclave: OK — 11 records, chain intact, signed by the expected key$ wl-enclave hosts --since 2026-11-03
HOST PORT VERDICT TRIES SENT RECV
pastebin.com 443 deny 20 - -
example.com 443 allow 20 34.4 kB 128.2 kBEverything from one command line
wl-enclave run
Run the agent in the sandbox, with a stated purpose.
wl-enclave kill / quarantine
Stop a run, or stop it immediately, and seal its evidence either way.
wl-enclave hosts
Every host your agents tried to reach, from verified bundles only, with the verdict and the bytes each way.
wl-enclave verify
Check a bundle offline: no account, no network, not even Watchlight.
wl-enclave keygen
Create the signing key once. You keep the private key; the public key id it prints is a fingerprint, which reviewers pin to check who sealed a bundle. There is no key of ours to trust or revoke.
wl-enclave ps / logs / evidence export
List runs, read what a sandbox wrote, and archive a bundle for a reviewer.
Docker is the first runtime. Runtimes plug in behind one driver interface, so other sandboxes can be added without changing the evidence format.
From one sandboxed agent to a governed fleet
Either half works alone: Developer Edition governs agents wherever they run, and Enclave seals evidence even for an agent that never calls the SDK. Together they give one agent a boundary and a record. When you need the same for many agents, Watchlight AI Beacon governs the fleet from one control plane.
Give your next agent a boundary and a record.
Install it, run your agent in the sandbox, and hand the bundle to your security review. Want help setting it up for your team? Talk to us.
pip install watchlight-enclave
Governing a fleet? Request a demo of Watchlight AI Beacon
From your laptop to production
Built something that works? Here is how it ships.
When an agent workflow moves from your machine to work, your security team will ask what limits the agent, how to stop it mid-run, and who authorized each action. A production-readiness pilot answers those questions on your workflow, with you and them in the room.
- Step 1Try it freeRun your agent in the sandbox and verify the evidence offline.Get Enclave on GitHub
- Step 2Take it to workSee what a pilot covers: the authority boundary, the tests, the stop, and the record.See the pilot
- Step 3Bring your security teamScope a pilot on your workflow, or talk to us about running Beacon at work.Scope a pilot Talk to us about Enterprise
We reply within one business day.