Connectors are SDK-shaped on the agent side and policy-enforced on the platform side. Secrets never leave Arx; the agent receives a short-lived handle. Every write is auditable, every high-risk action is gate-able, every rotation is a platform operation — not a deploy.
Endpoint actions are where agents do the most damage when they misbehave. Every write here is behind a declared approval gate by default. Simulation mode lets you flip enforcement on safely.
Detections, incidents, host containment, RTR commands, IOA/IOC management. Write paths default-gated with diff preview for approvers.
detections.listincidents.aggregatehosts.contain · approvalrtr.execute · approvalThreats, deep visibility queries, network quarantine, agent management. Designed so a CAB-approved runbook can execute in seconds without credential handoff.
threats.listdv.queries.runagents.disconnect · approvalthreats.mitigateDefender XDR, Defender for Cloud, Defender for Endpoint, Identity. Cross-product alert correlation exposed as a single connector surface.
alerts.listincidents.getmachineactions.isolate · approvalincidents.updateCloud-write connectors ship with a declared blast-radius contract. Resource-level gate rules, not just action-level — so "destroy test S3 bucket" doesn't unlock "destroy prod."
Deactivations, unlocks, MFA resets — the highest-frequency agent write target and the one most frequently misused. Default-gated, with per-OU scoping.
Query timeouts, row limits, and per-index ACLs enforced in the connector. Your agent can't accidentally DoS the SIEM because the policy won't let it.
The most common "agent did something weird" surface area. Every state transition is policy-evaluated against the CAB-defined transition graph for that table.
Per-channel rate limits and recipient ACLs enforced server-side. Your agent will not accidentally at-here the entire company because a prompt told it to.
If your agent needs a tool we don't ship yet, we build it — on-contract, with the same SDK shape, secret-handling posture, and control-bound evidence emitter as every other connector in the catalog. You file a spec, we build, your review board gets exactly one new artifact to review.
30-minute demo. We'll swap one of your agents onto Arx-managed connectors and show you the audit trail, approval gate, and control-mapped evidence emitter live.