An AI security platform has to cover the whole path from the person or workload that signs in to the model, tool or agent that answers. Skyfix puts inspection inside the request path, not beside it, and keeps identity, keys, sessions and posture in the same console as the traffic they protect.
One control plane
Inspection runs on input, output, streams, MCP and A2A with fail-closed holdback. External guardrail services can add a check but never replace it.
Identity
Policy
AI Firewall
Budget
Route
Evidence
The AI Firewall inspects prompts, responses, streamed chunks, MCP tool arguments and results, and A2A messages for prompt injection and jailbreaks, credentials and secrets, system prompt leakage, personal and health data and harmful content. Each protection is set per workspace to block, redact or monitor, and the action applies before a model or a caller sees the content. Detection content ships as signed packs your installation verifies and re-signs under its own keys, and findings open review cases in governance.
02
People sign in through your identity provider with OIDC or SAML, are provisioned and deprovisioned with SCIM, and can be required to use multi-factor authentication. Roles are scoped to the organization or to a workspace, and every permission that reads content, exports data or changes production is distinct, so a reader of traces does not automatically see prompts.
Directory, sign-in and roles are administered in the same console as keys and policy, which means an offboarding in your directory ends console access, API keys and approvals in one place.
03
Workloads do not share human credentials. Applications use scoped API keys that carry allowed models, tools, environments, expiry and tags; services use workload identities and client certificates; and gateways enroll with their SPIFFE ID bound to the enrollment, so a gateway cannot be impersonated by copying a token. Keys are issued, rotated and revoked in the console, and every issue and revoke is audited.
04
Session policy is enforced by the server on every request: an idle timeout from 5 minutes to 12 hours, a session lifetime from 1 to 24 hours and a step-up window from 1 to 60 minutes, with a warning before expiry and a sign-in that returns you to the page you were on. Password policy sets length, history, lockout and always applies a blocklist of common and personal passwords. Step-up re-authentication is required only for high-risk operations: every console route is classified, and an unclassified route requires step-up by default.
05
Posture evaluates identity, keys and AI assets continuously: people without MFA, keys without expiry, agents without a workload identity, tool servers with unreviewed catalogs. Each finding has a severity, evidence and a link to the asset, and feeds the readiness of every AI system that uses that asset. Snoozing or dismissing a finding is recorded in the audit trail with who did it and why.
The Helm chart installs ingress and egress network policies that are default-deny for private ranges, so private destinations must be allowlisted, and public egress can be restricted to approved addresses. Each workload has its own secrets-store role and reads only its own credentials; TLS is required outside development; and gateways authorize every request against a signed bundle they verified locally. During an incident the emergency deny switch and last-known-good bundles keep the fleet under control from a signed state.
No detection efficacy, block-rate or false-positive figures are claimed here.
FAQ
The whole path: how people and workloads authenticate, which keys and scopes they hold, what the AI Firewall inspects inline, how sessions and step-up are enforced, what the posture findings say about your identity and AI assets, and how the runtime itself is locked down. Skyfix covers all of it in one console.
OIDC and SAML for single sign-on, SCIM for provisioning, OAuth 2.1 for MCP client authorization, SPIFFE for gateway enrollment and mTLS between planes, plus scoped API keys and client certificates for workloads.
A gateway enrolls with its SPIFFE ID bound to the enrollment and talks to the control plane over mTLS anchored on the installation CA. It verifies every bundle and directive it receives against your installation's signing keys.
Step-up is a fresh re-authentication within a configurable window, required only for high-risk operations such as publishing policy, exporting audit records or changing production. Every console route is classified; a route without a classification requires step-up by default.
An emergency deny switch stops traffic for the scope you choose, last-known-good bundles let a fleet roll back in one signed action, gateways keep enforcing their verified policy if the control plane is unreachable, and every action taken is in the audit trail.
Next step
Deployed in your Kubernetes, under your keys.