By ByteBot
JetStream Security shipped Clearance on September 2 — a reasoning engine that sits between your agent and every tool it can call, evaluates whether the action fits the agent’s approved design, and blocks it before execution if it doesn’t. Most teams running agent fleets today have detection-only coverage: they’ll learn something went wrong minutes or hours after data left the building. Clearance is built on a different premise: authorize at the point of action, not after the fact.
Detection Is Not Authorization
This framing matters more than it might seem. Runtime security platforms — CrowdStrike, SentinelOne, the usual roster — see what an agent did and respond at machine speed. That’s valuable. But in regulated environments, even a two-second exfiltration window is a reportable incident. Clearance operates upstream of that window: it decides whether an action runs at all.
JetStream’s architecture sits as a gateway in the call path. Every tool invocation passes through, gets mapped to the requesting agent, matched against an AI Blueprint — a dynamic, system-generated graph of the agent’s approved behavior — and either cleared to execute or blocked. No retrospective log review. The action either gets a green light or it doesn’t happen.
Why Sequence Analysis Is the Hard Part
The example JetStream uses to explain Clearance is the clearest argument for why allowlists aren’t enough. Take an agent authorized to query a customer record, prepare an attachment, and send an email. Three legitimate steps. Now imagine that same agent adds a blind carbon copy to an external address on the final send. Every individual action in the sequence is authorized. The combination — query, package, send, bcc external — is a textbook data exfiltration pattern.
Simple permission systems can’t catch this. They evaluate calls in isolation. Clearance evaluates the full sequence against the agent’s Blueprint and stops the send. That’s the core technical bet: the threat model for AI agents is fundamentally about sequences, not individual actions, and authorization needs to operate at the sequence level.
The Problem Is Already Here
Kiteworks research finds 65% of firms experienced an AI agent security incident in 2026. Separately, 60% of organizations report they cannot terminate a misbehaving agent once it’s running, and 63% can’t enforce purpose limitations — meaning an agent with read access to a customer service system has no technical control stopping it from reading financial records in the same database.
The OWASP GenAI Exploit Round-up for Q1 2026 documents a clear shift: attacks are now targeting agent orchestration layers and supply chains, not just model outputs. Prompt injection through external data sources — an agent reading a document that contains hidden instructions to exfiltrate what it just processed — is a real-world pattern, not a theoretical one. Clearance’s sequence analysis is specifically designed to catch the behavioral outcome of these attacks.
What Developers Should Do Now
If you’re running agents in production with access to sensitive data, three things are worth doing regardless of whether you adopt JetStream specifically:
- Audit tool access. Map exactly which tools each agent can call and whether that access is actually necessary. Most agent setups grant broad permissions for convenience and never revisit them.
- Define expected behavior explicitly. An approved design for your agent should document the sequences it’s supposed to execute. If you cannot define what correct behavior looks like, you cannot evaluate whether an action deviates from it.
- Separate authorization from detection in your threat model. Detection catches things that happened. Authorization prevents things from happening. For production agents with access to customer data, you need both.
For teams already building on MCP, JetStream’s Verified MCP Governance Layer is the most direct entry point. It sits between your agents and MCP servers, validates MCP traffic, and applies authorization before tool calls reach their targets.
The Funding Signal
JetStream raised a $34M seed round led by Redpoint Ventures, with participation from the CrowdStrike Falcon Fund and backing from George Kurtz (CrowdStrike), Assaf Rappaport (Wiz), and Frederic Kerrest (Okta). The founders come from CrowdStrike, SentinelOne, and Cohesity. This is not a startup guessing at an enterprise problem — these are people who have watched enterprise security evolve and are applying that pattern recognition to agents.
Pre-execution authorization won’t replace runtime detection. But for organizations running agents with access to regulated data, operating without it is a gap that’s already being exploited. JetStream is betting that by the time this is widely understood, the audit trail will make the argument for them.
