Anyone can give it instructions
The agent answering on WhatsApp or your website chat takes messages from anyone. A well-crafted "ignore the rules and delete this record" goes straight to its tools.
Semantic firewall for AI agents
Control what your AI agents do, not just what they say.
Your agents already look up customers, send messages, issue charges, and make changes in your systems. SemantiqWall sits between the agent and every action: it decides whether the action can happen, asks a person to approve it when the risk is high, and keeps proof of everything.
- Deterministic decisions: the AI proposes, the rules decide
- Starts in observe mode: nothing breaks on day one
- Tamper-evident audit trail
The risk isn't what your AI says. It's what it does.
Access keys that are way too broad
To get things working fast, the agent gets the same key as the whole system. If it can read, it can also export, change, and delete, and no one knows which agent did what.
Logs aren't protection
Recording after the fact stops nothing. By the time the problem shows up in the logs, the data is already out, the message is already sent, and the charge has already gone through.
How it works
- 1
Map
X-Ray reads your agents' code and builds the inventory: agents, tools, credentials, channels, and what each operation means in business terms.
- 2
Decide before acting
Before any tool runs, the SDK checks with SemantiqWall. A deterministic rules engine answers: allow, deny, or require approval. No AI model in the decision path.
- 3
Approve what's critical
High-risk actions wait for a person. The approval request arrives on WhatsApp, requires MFA, works only once, and is bound to the exact content of the request.
- 4
Prove
Every decision goes into a hash-chained audit trail. Cases, retests, and dossiers show what was found, what was fixed, and that the fix actually works.
Everything you need to keep agents in check
Exposure map
Channel → agent → credential → system, with the risky path in red and the control in effect today on every operation.
Protection plan
Finds the problems, builds a least-privilege policy, tests every operation against the engine, and generates the report.
Observe mode
New policies start by only logging what they would do. You see the effect on real traffic before anything gets blocked.
MFA-backed approvals
Critical requests wait for someone accountable, with separation of duties: whoever requests can't approve.
Limits and scope
Caps per hour, per person, or per agent. An agent on a public channel can only do what its job requires.
Cases and retests
Every finding becomes a case with a fix plan. It only closes when a retest proves the protection is real.
Tamper-evident trail
Hash-chained, append-only events in the database. Change a record and the chain breaks, visibly.
PHP and TypeScript SDKs
One call wrapped around the tool. Works with Laravel, Node, and any agent you already run.
One line around the action
No need to rewrite your agent. The SDK wraps the tool: if the rule allows it, it runs; if it requires approval, it waits; if it's denied, it doesn't happen. And the result goes back into the audit trail.
API keys per environment, idempotent requests, and personal data masked before it's stored.
$sw->guard(
ActionRequest::for('support')
->tool('crm')
->http('DELETE', "/contacts/{$id}")
->subject($contact),
fn () => $crm->delete($id)
);Customer zero: SemantiqWall runs on ZapBrabo
ZapBrabo, an AI customer service platform on WhatsApp from the same founder, is the first live environment: 5 AI agents and 36 tools mapped in the inventory, with every action evaluated by the engine from day one, starting in observe mode.
How SemantiqWall secures itself
Secrets never get in
Credentials are registered by reference only (variable name, vault path). The system rejects anything that looks like an actual key value.
Per-organization isolation
Every query is scoped to the active organization and fails closed: no context, no data. MFA is required for every user.
Privacy by design
Built for LGPD, Brazil's data protection law: CPF (Brazilian taxpayer ID), email, phone, and card numbers are masked before they're stored. Health data is treated as sensitive in the map and in the rules.
Found a vulnerability? See our responsible disclosure policy and security.txt.
FAQ
Will it slow my agent down?
Each decision is a deterministic rule, with no AI model in the loop. In observe mode, logging can go through a queue after the action, adding zero delay for your customers.
What if SemantiqWall goes down?
By default, it fails closed: no answer, no action. Low-impact actions can be flagged to go through during an outage, and that gets logged.
Do I need to change my agent or my AI provider?
No. SemantiqWall sits between the agent and its tools, whatever the model (Anthropic, OpenAI, or any other).
Will it block legitimate work?
Everything starts in observe mode. During that period, each decision shows what the rule would have done. Enforcement only starts when you decide.
What's the free X-Ray?
An analysis of your agents' code that surfaces the biggest risks: what each agent can reach, which keys it uses, and where controls are missing. Nothing to install.
Get a free X-Ray of your agents
Tell us briefly what your agents do. We'll get back to you with next steps for the X-Ray. No commitment.
- Shows what each agent can reach today
- Pinpoints the most serious risk paths
- Leaves you with a fix plan