Protect what agents access, run, and change—from the first tool call to the final business action. One enterprise platform for safer work and focused security.
Built on UC San Diego
Read why Two Small FishAn ordinary business request can become a script, a package install, a subprocess, or a change in another application. Gensee connects those steps to the same task, authority, and evidence.
Documents and tool calls
Generated code and packages
Processes and subagents
Outputs and application changes
Illustrative workflow. An agent’s change of strategy should not become a change of permission.
Let approved work proceed under reusable policy. Use safer alternatives when a risky step can be repaired, and involve people where the business consequence warrants it.
Screen routine findings first, enrich the exceptions with task context, and give analysts a focused brief. Tune for low false positives without losing high-risk evidence.
Built for operations-heavy businesses, from business services and logistics to internal manufacturing teams. Operations, IT, AI platform, and security share the outcome.
Resolve order and service exceptions without widening access or making an unrelated change.
Explore the scenario ↗02Turn approved data into useful analysis while governing code, exports, and proposed updates.
Explore the scenario ↗03Reconcile records and prepare corrections while keeping payment and recipient changes bounded.
Explore the scenario ↗04Delegate document and application work with clear file, account, and publishing boundaries.
Explore the scenario ↗05Explore fixes, inspect dependencies, and validate the exact artifacts promoted from an isolated workspace.
Explore the scenario ↗06Keep retries and delegated work inside the original authority, even after hours of execution.
Explore the scenario ↗Follow one finance-file change through the actual product. Every screen has a job to do.
Scroll to follow the investigation
1
2
3
01 / Activity
See what the harness reported, including its stated outcome.
A finance-file change sits alongside ordinary project work.
Source labels distinguish runtime reports from independent OS observations.
1
2
3
02 / Policy & alert
The finding names the company condition and policy revision.
Inspect the reported write to forecast.csv and its source context.
Carry the finding and its supporting evidence into an investigation.
1
2
3
03 / Investigation
The saved case links back to the original detection.
Review the resource, reported outcome, and matched condition together.
Preserve a record of changes and assessments as the investigation develops.
1
2
3
04 / Employee context
Ask about the relevant action and task, with supporting context.
Retain the response alongside the investigation evidence.
Document the decision. An explanation does not automatically change policy.
Actual product · synthetic demonstration. The console and evidence workflow are real; source reports and the employee explanation are simulated. These screens demonstrate investigation, not preventive blocking.
Silent walkthrough with on-screen captions. The annotated screens above provide a text alternative for the workflow.
Existing evaluations of agent defense and detection. Assess protection and legitimate task completion together in your own supported workflow.
Baseline and Gensee results across three evaluated threat categories. Higher is better.
+18.8 percentage points
+34.6 percentage points
+15.7 percentage points
Gensee’s internal evaluation using an adapted AgentCanary harness; these are not official leaderboard results.
We achieve higher recall and accuracy with a lower false-positive rate on the Uber ADR-Bench dataset.
| Metric | Baseline | With Gensee | Change |
|---|---|---|---|
| Recall Higher is better | 73.8% | 92.9% | +19.1 pp |
| False-positive rate Lower is better | 13.8% | 11.5% | −2.3 pp |
| Accuracy Higher is better | 84.5% | 89.1% | +4.6 pp |
Recall measures how many positive cases are detected. False-positive rate measures how often negative cases are incorrectly flagged. “pp” means percentage points. Baseline refers to the configuration recorded in Gensee’s internal evaluation, not Uber’s production system.
0.6%–1.2%runtime overhead
10–400 msper request
Gensee connects task authority, artifact risk, and business effects. Keep useful work moving as agents switch tools, generate code, and delegate tasks.
Explore customer scenariosControls are scoped to your supported execution environment and application integrations.
Connect each task to its authorizing person, permitted resources, and action limits. Give security decisions the context of the work, with unrelated files, accounts, and credentials kept outside its scope.
Connect code, dependency, and tool findings to the task and the artifact actually being used. Repair unsafe artifacts or choose a safer alternative, then independently validate the result.
Carry the original limits beyond the first tool call—through supported scripts, installs, subprocesses, and delegated agents. Contain failures and recover supported local state without expanding the task’s authority.
Validate the exact output and govern supported records, operations, recipients, and cumulative limits. Preauthorized actions proceed; consequential exceptions reach a person with connected evidence.
A trusted control plane connects task context to controls at supported system and application boundaries. Inspection, identity, and storage tools contribute through shared interfaces.
Who authorized the work, which resources it can use, what it may change, and when its permission ends. Policy and approval state stay outside agent-controlled workspaces.
Processes and descendants, files, credentials, executables, and network paths.
Generated code, dependencies, installation behavior, and the exact output approved for use.
Supported records, recipients, operations, and cumulative action limits.
Enrollment · Roles · Central policies · Updates · Health & coverage · Audit exports
A scan is evidence, not permission. A clean artifact still needs authority to change a business record or send a message.
A child task cannot grant itself more access. Delegation and retries share the original task’s limits.
Coverage is defined by the supported OS, runtime, harness, and application integration. Vendor-hosted execution needs an accessible enforcement point; local recovery cannot undo a sent message or disclosed information.
Founded by UC San Diego professor Yiying Zhang and former Google engineering leader Shengqi Zhu, Gensee brings systems research to agent safety. Meet the team
How live workspace branches return useful results—and where their boundaries end.
Read the research ↗ LONG-HORIZON AGENT SAFETYWhat real incidents teach us about shared services, persistent state, and control over time.
Read the analysis ↗Answers for the people doing the work—and the people protecting it.
Gensee brings task authority, execution protection, artifact inspection and repair, application controls, and correlated evidence into one enterprise platform. It is designed to protect supported agent workflows from human mistakes, agent errors, and malicious inputs.
Teams with agents that already read sensitive information, run code, or change business systems. Operations and support are a natural starting point, with analytics, finance, and engineering workflows also in scope. The operational owner, platform or IT team, and security team define the boundaries together.
The approach is to protect your existing agents and workflows. Coverage depends on the supported runtime, harness, OS, and application connectors. An inaccessible vendor-hosted agent needs a supported integration or a control point at the resource it uses.
Preauthorized work should proceed under reusable policy. Routine screening and connected context are designed to reduce false alerts and unnecessary approvals. Human review focuses on consequential exceptions; model confidence alone does not authorize an action or discard high-risk evidence.
Inspection supplies evidence about code, packages, and tools. Gensee connects that evidence to task authority and execution policy. A safer version or repaired artifact must be independently validated, and approval must apply to the exact artifact used. A passing scan does not grant new permissions.
No. Recovery applies to supported local state. It cannot unsend an email, reverse an arbitrary remote transaction, or recall disclosed data. Those effects need controls at the application or resource boundary before they occur.
The architecture describes the unified platform direction. The console walkthrough and benchmarks show specific existing work; they do not establish coverage for every execution path. We scope the supported configuration and demonstrate the protections available for your workflow.
Bring the task your team delegates.
We’ll help map the boundaries that matter.
Start with the work you already delegate.
See what it takes to protect the path from request to result.
