Agent protection in Centeye is in early access. This post explains how it works and what it is built to do.
In what guardian agents are we covered why businesses adopting AI agents need something supervising them. This post explains how Centeye does it: the Praxis guard agent, working with Centeye Synthwatch.
The short version: Synthwatch knows every AI agent and what normal looks like for it. Praxis watches for an agent going off script, links it to the people, devices and data around it, and stops it within the rules you set.
The design choice: guard from the outside
There are two ways to supervise an AI agent. You can sit inside its conversation and filter every prompt and answer. Or you can guard it from the outside, through the things every agent needs to act at all: its identity, its keys, its app grants and the sharing that decides what data it can reach.
Centeye takes the outside route, for three reasons:
- It works whoever built the agent. Copilot, Gemini, an AI app someone connected, or an agent your client built. There’s nothing to rebuild.
- It can’t be talked out of it. An agent can be tricked by a clever prompt. Revoking its access stops it whatever it was told.
- It’s how MSPs already work. Identity, access and app grants in Microsoft 365 and Google Workspace are the same controls MSPs manage for people.
How it works, step by step
1. Know every agent
Synthwatch connects to Microsoft 365, Google Workspace and their connected apps and lists the agents already working there, as they appear. Each one goes into a register with:
- Its own identity, or a flag if it’s running on a shared or admin account.
- A human sponsor, the person who owns it and answers for it.
- What it can reach: the mail, files, apps and data its access allows.
- A review date, so nothing stays approved forever.
AI apps that people connect, found by Centeye Lumen, are handed over as registered agents with their owner.
2. Learn what normal looks like
For each agent, Synthwatch builds a behaviour profile: how much it usually reads, which apps it usually calls, and when it usually works. An invoice agent that reads a few dozen files on weekdays has a very different normal from a support agent answering hundreds of tickets.
3. Spot the agent going off script
The guard agent looks for three kinds of trouble:
- Behaviour outside its profile. Reading a thousand files at midnight, or calling an app it has never used.
- Access beyond its job. Write access it doesn’t need, or a finance share it shouldn’t see.
- Trouble around it. Its sponsor’s account taken over, its key showing up somewhere it shouldn’t, or one compromised app reaching into the next.
4. Link it to everything around it
An agent alert on its own is a question. Praxis turns it into an answer by joining it to the rest of the picture in one case: the agent, its sponsor’s account, the sponsor’s device, the mailbox, and the data the agent touched. If Centeye Gatewatch finds the sponsor’s account was taken over, every agent that person owns is reviewed in the same case.
Praxis can also ask the sponsor why. “Your invoice agent just read 1,200 files. Was that expected?” A quick yes or no from the person who owns it settles many cases in seconds.
5. Act, at your setting
When an agent needs stopping, the guard agent can revoke its access, reset its keys and contain the spread between connected apps. You choose how far it goes alone, action by action:
- Recommend only: it says what it would do and why. Nothing runs.
- Ask first: it prepares the step and runs it after one approval, from a phone if needed.
- Automatic: it runs clear-cut, protective steps on its own and checks they worked.
6. Prove it, and record it
Every action is checked afterwards at Microsoft or Google, undone where the provider allows, and recorded: who, what, why and when. The owner gets a plain-English summary of what happened and what changed.
The guard rails on the guard
A guard agent is an agent too, so it needs rules of its own. In Centeye:
- Risky steps never run on their own, whatever the setting.
- Agent-run remediation sits behind a switch that is off by default. You turn it on when you’re ready.
- Centeye’s own AI agents work only through governed tools, inside your rules, like any other agent it watches.
- Every step is recorded in a tamper-evident chain.
A worked example: the copilot that could see payroll
This is an illustrative example, not a real client. An MSP rolls out an AI assistant to all 50 staff at a client. A week later an intern asks it about “salary bands” and gets an answer.
- Synthwatch finds why: the payroll folder is shared with everyone, so the assistant can surface it to anyone who asks.
- Praxis opens one case with the assistant, the folder and who could see it, and recommends the exact sharing change.
- The owner approves it with one tap. Synthwatch confirms the assistant can no longer reach the folder, and the register records the fix.
Nothing was hacked. But without a guard watching what agents can reach, the first sign would have been a salary conversation nobody wanted.
What it isn’t
Being clear about scope matters as much as features:
- It doesn’t filter prompts or rewrite agent answers. It works through identity and access, from outside the agent.
- It doesn’t replace the agent vendor’s own controls. It adds a supervisor above all of them.
- It doesn’t make the final call on disruptive steps. People do.
Checklist: questions to ask any guard agent
- Does it find agents you didn’t know about, not just the ones you registered?
- Does every agent get a human owner and a review date?
- Can it see what each agent can reach, not just what it did?
- Does it link an agent’s behaviour to the person and account behind it?
- Can you choose recommend, ask first or automatic, per action?
- Are risky steps always left to a person?
- Is every action checked afterwards and recorded?
- Is the guard itself limited to governed tools?
Getting started
Synthwatch and agent protection in Praxis are in early access for MSPs and businesses already using AI agents. Read more about Centeye Synthwatch and Centeye Praxis, or ask for early access.
Frequently asked questions
What does the Praxis guard agent do?
It supervises AI agents. Working with Synthwatch, it knows every agent and its owner, watches for behaviour or access outside the agent’s job, links it to the people and data around it, and stops the agent within the rules you set.
Does it work with Microsoft Copilot and Google Gemini?
Synthwatch connects to Microsoft 365, Microsoft Entra ID, Google Workspace, Microsoft Copilot and Gemini, and works through identity and access, so it supervises agents whichever vendor built them.
Will it shut down an agent without asking?
Only if you set that action to automatic, and only for clear-cut, protective steps such as revoking access. Risky steps always wait for a person, and agent-run remediation is switched off until you turn it on.
Is this available now?
It’s in early access. Ask to join and we’ll set it up on your own tenant.
The worked example is illustrative. Synthwatch and agent protection in Praxis are in early access; this post describes how they are built to work. Centeye describes only capabilities that ship in the product, and marks early-access products as such.