TC360 · Protect

A kill switch and audit trail for live AI agents

TC Protect gives security teams a control point when agents move from pilot to production. Pause an agent. Block unsafe runs. Record metadata-only audit evidence. Prove who changed what, when, and why.

Vendor security review Incident response Audit trail Private deploy

Run TC Diagnose first (one workflow free per company). Add TC Protect Live when agents go live: from $750/month per workflow (TekCapitol-hosted).

Try kill switch demo → Request TC Protect pricing → Tour TC Protect product → TC Protect edition TC Diagnose → Try TC Fix demo →

DIAGNOSE. FIX. PROTECT.

TC Diagnose proves readiness (PDF, WGR, evidence, TC Fix queue). TC Fix closes gaps: upload, scan, connect, Fix now. TC Protect runs when the agent is in production: gate checks, pause authority, and audit evidence.

TC Diagnose · Diagnose → TC Fix · Fix gaps → TC Protect · guardrails in prod
ARCHITECTURE

Independent control plane: your app checks the gate before each run. Security pauses from the dashboard. Metadata-only audit log. Slack and SIEM alert webhooks are Phase 2 (on roadmap).

Live today: gate API, kill switch, metadata audit log. Alert dispatcher (Slack / SIEM): Phase 2.

CUSTOMER ENV TC Protect (HOSTED OR VPC) YOUR STACK Agent apporchestrator Agent + toolsCRM, APIs, data Gate APIcheck_gate / ingest Kill switchstate Audit logmetadata only Alert dispatcherSlack + SIEM webhooks TC Protect dashboardpause / resume / config Slack#incidents SIEMSplunk · Datadog · PD SOC / SIEMinbound signal (roadmap) Security / IRCISO · GRC 1 gate allow / block 3 ingest pause alert audit JSON pause incident Pre-prod: TC Protect assessment defines policy · Post-prod: gate enforces + alerts notify
PRODUCT TOURS

See Diagnose, Fix, Protect

TC Diagnose report demo on the homepage. TC Fix gap scan and TC Protect are live interactive tours in the app.

TC Diagnose video → TC Fix demo → Tour TC Protect →

01 · READINESS

Security assessment

Agent risk register, access boundaries, permission audit, authorization architecture advisory (OPA, OpenFGA, Cedar patterns and starter templates), kill switch policy spec, IR playbook template, Workflow Governance Record, evidence pack, and draft security questionnaire answers. For RAG workflows we specify index scope and ACL inheritance tests. We do not crawl your vector DB or enforce retrieval permissions at runtime.

Start TC Protect assessment →
02 · CONTROL

Hosted kill switch

Gate API before each run. Pause from dashboard during incidents. Metadata-only audit log. Slack and SIEM webhooks: Phase 2.

Manage kill switch →
03 · DEPLOY

Private deploy

Run kill switch in your VPC when data residency requires it. Same API, your environment. Enterprise and regulated deals.

Request private deploy →
HOW IT WORKS
  1. TC Diagnose · Readiness report defines govern, monitor, and kill switch policy spec
  2. TC Fix · Apply playbook packs and connector fixes from the road map
  3. Register · One production workflow = one scoped API key
  4. Gate · Your app calls check_gate before each agent run (protect)
  5. Respond · Security pauses from dashboard; gate blocks execution
  6. Alert (Phase 2) · Slack and SIEM webhooks on pause, blocked runs, and audit events
  7. Prove · Audit log records changes and gate decisions
Hosted TC Protect

Security spec is bundled with every TC Diagnose report (one workflow free per company, then $5,000 per workflow). TC Protect Live Launch is $750/month per workflow on TekCapitol-hosted SaaS (gate + kill switch + metadata audit log). Pilot, Production, and VPC deploy are scoped on a 30-minute call.

LAUNCH
$750/mo

Per workflow · TekCapitol-hosted · first agent into production with gate + audit.

PILOT
Scoped on call

Multi-workflow pilot with security review cadence.

PRODUCTION
Scoped on call

Fleet scale, private deploy, regulated environments.

Request TC Protect pricing →

TC Diagnose proves readiness, TC Fix closes gaps, TC Protect protects when live. Start at tekcapitol.com/tc360. See pricing.