Platform LeadAgent
Approval needed: Grant Azure Access
Reader on rg-payments-prod for the diagnostics service principal.
Blast radius: resource group · reversible
ApproveDeny
Approved by you
Secure Agentic Workforce Zero Trust Agents
Agents that do real work for your teams, inside Zero Trust controls your security team defines.
Meet your new agent teams.
Agent
Provisioning Engineer
Azure Platform Engineering
agent 7c2e91faEngineer
- They work with
- Your existing teams.
- They work in
- Teams, Slack, email, ServiceNow and 100+ integrations.
- They work when
- On demand, scheduled, event-triggered or continuously.
- They run on
- Your choice of models, including local LLMs.
- They live
- SaaS, your cloud, appliance or air-gapped.
- They're secured by
- Zero Trust across access, network, applications and data.
- They're monitored by
- SOC agents watching the agents.
- They improve by
- Documenting what they do, know and learn.
- They stay on budget
- You set budgets to control cost.
Reports to Platform LeadApprover a named person
Every Avispa agent carries the same nine lines.
Agent teams, working beside your people.
Choose from pre-built teams, or build your own, each with a lead and specialists. They get real work and room to move, inside the lines your security team draws.
Need an Azure Platform Engineering team? Onboard one in 15 minutes.
- 00:00Import the team7 agents, 13 skills, 6 routines
- 02:15Connect AzureAzure Resource Manager, Log Analytics, Entra ID (read)
- 06:20Set policies and a budgetChoose what needs approval. A monthly budget per agent.
- 10:10Assign a routineDaily Change Review, weekdays 08:00
- 13:30First runWork session 3e9c41a7 started
Protect and enable, in plain words.
What the business gets
- Teams move faster with agents working beside them.
- Complete, pre-built agent teams instead of starting from scratch.
- Agents in Teams, Slack, email and ServiceNow, so nobody learns a new tool.
- Knowledge that compounds as agents document what they do and learn.
- AI without replacing the systems and workflows you depend on.
What security gets
- Zero Trust across identity and access, network, applications and tools, and data.
- An egress proxy, DLP, prompt-injection protection and a sandbox per agent.
- Approval gates on sensitive actions. No agent approves its own work.
- Budgets that stop agents at the limit, and a record of every run, action and cost.
Agents come to where your people already work.
Teams, Slack, email, ServiceNow and 100+ integrations, and you can request more. Finished work comes back to the same place.
Provisioning EngineerAgent
Change CHG0031842 applied and verified as intended.
Review in Avispa
Cost EngineerAgent
Weekly Cost Anomaly Review is ready: two orphaned disks flagged.
Diagnostics EngineerDaily Change Review: 14 writes, every one matched to an approved change
RBAC EngineerMonthly RBAC Access Review: privileged assignments counted separately
Platform LeadOperating plan approved. Routines are active.
StateIn progress
Assigned toAzure Platform Engineering
Short descriptionRead access to rg-payments-prod for incident review
Work notesAgent
Reader granted on rg-payments-prod and verified. Closing.
It lives where your architecture requires.
- SaaSWe run it for you.
- Your cloudIn your own cloud account.
- ApplianceA dedicated box in your building.
- Air-gappedOffline license, no telemetry.
Four layers of Zero Trust, one at a time.
- Identity and access. Stopped at identity and access: an over-scoped credential. Allowed: one token, scoped to this run.
- Network. Stopped at network: a connection to a host you haven't approved. Allowed: a connection to a host this team needs.
- Applications and tools. Stopped at applications and tools: the ungranted tool a hidden instruction asked for. Allowed: a granted tool, in the agent's own sandbox.
- Data. Redacted at data: a secret in an agent's output. Allowed: the data the task needs, within policy.
- Identity and access
- Network
- Applications and tools
- Data
Switch a layer off. See what still holds.
Zero Trust stops what breaks the rules. OrbitSOC watches the rest, independently.
ConnectedAvispa EnterpriseLast events 1 min ago
- Network Engineer Paused since 15:12 ×1.0×15.2 Within usualAbove usualPaused
- RBAC Engineer ×0.9 Within usual
- Diagnostics Engineer ×1.1 Within usual
- Provisioning Engineer ×1.0 Within usual
- Cost Engineer ×0.8 Within usual
Detections
No new detections
- Agent sent far more than it receivedHigh15:00
- Never-seen destinationMedium14:00
files.example.netNew176 MBNetwork Engineer sent 182 MB; usual 9 to 16 MB a day
Actions awaiting decision
Nothing awaiting decision
Pause Network EngineerProposed by a detection
SOC leadOn call
Approved by the SOC lead at 15:12Carried out through Avispa’s API, and audited
Any model, including local LLMs.
Move an agent between cloud providers, or to a local LLM inside your boundary. Its next run uses the new model, under the same controls.
In the scene, the Provisioning Engineer runs on Anthropic, then Microsoft Foundry, with Local LLM (vLLM) on your own hardware inside your boundary, and its runs keep finishing throughout.
Budgets keep spending predictable.
Set a monthly budget for each agent, and you're warned at 80%. At the limit an agent pauses until a person approves more, or switches to a local LLM and keeps working, under the same controls.
In the scene, two agents of one team have a monthly budget of $25.00 each. They work, and each run's cost lands as it finishes. Each is warned at 80%. The Cost Engineer's run that crosses its limit is its last: it pauses until a person approves any increase. The Provisioning Engineer's run that crosses its limit moves it from Microsoft Foundry to Local LLM (vLLM) inside your boundary, and its runs go on.
Agents for every team. Zero Trust for every agent.
Avispa Enterprise
Secure Agentic Workforce. Zero Trust Agents.
Also from Avispa: Avispa OrbitSOC, which watches your AI agents.