See what your developers send to AI.
Control it without slowing them down.
You see what your developers send to AI tools, block the risky moments, and keep proof your auditor can check — all in your own cloud. Most requests pass without anyone noticing. Only a genuinely risky one ever stops for approval. Three pieces make that work: a small proxy on the machine, a control plane in your cloud, and a record your auditor can verify.
One hop — and it never
leaves your cloud.
Your developer's AI tool reaches the model through Tether, running in your own cloud account. Tether sees the request, applies your policy, and records it. Nothing routes through us.
No Tether-hosted transit. Policy verified offline. No root certificate on the laptop.
How much it sees depends on the tool. For the CLI agents and editors your developers live in — Claude Code, Codex CLI, Aider, Zed, Continue — Tether reads the full prompt and response and enforces against it. For tools with an opaque path — Copilot chat, Cursor's default flow on unmanaged devices — it attributes the activity to a person and a vendor and can block the destination, but it won't claim to read prompt content it can't see. "See what your developers send" means full content on the tools that route through the proxy, attribution-level coverage on the rest. The per-tool reality is on Controls.
AI requests leave from the developer's machine.
So that's where Tether watches them.
A cloud proxy your developers can route around is just a policy document with a certificate attached. Your EDR sees the connection but not what's inside it. Tether puts the control where the risk is — the moment a prompt leaves the machine — and reports to a control plane your security team owns and signs into. So you see the traffic, you set the rules, and you can prove both. No heavy rollout your developers will resent.
A proxy on the machine. A control plane in your cloud.
An audit trail you can prove.
Each one does a specific job. The machinery behind them — the ports, the signing chain, the enforcement tiers — lives in the technical brief for whoever needs to check it.
You see the channel — and risky moments stop before they leave
A lightweight proxy sits in front of the AI tools your developers already use. It attributes every request to a person, an agent, and a host, and blocks the patterns you can name — credentials, customer IDs, secrets — for the tools that route through the proxy, before those patterns ever reach the vendor. No root certificate goes on the laptop, so it doesn't decrypt anything it shouldn't.
The control plane is yours — no vendor data lake to trust
One control plane per tenant, deployed in your own GCP or AWS account. You author policy; it reaches the whole fleet in about ten seconds, cryptographically signed. No traffic flows through Tether-owned servers, so there's no Tether-side data to breach — and nothing to expunge if you walk away.
Every decision becomes evidence your auditor accepts
Every decision carries the policy version that made it, and streams to the SIEM you already run. When an auditor asks what your developers sent to AI tools and under which policy, you hand them a record they verify offline — without taking Tether's word for any of it.
Want the architecture diagram, the exact request path, and the three enforcement tiers? Read the technical brief →
Most actions pass untouched.
Only real risk ever prompts a human.
Safe work flows straight through
The overwhelming majority of prompts carry nothing sensitive. They pass without a prompt, a ticket, or a delay — they're simply seen and recorded.
Known patterns block on their own
A live credential or a customer-ID pattern you've defined is stopped deterministically — no model, no waiting, no human in the loop. The developer sees a clear reason.
A person decides in seconds
For the genuinely ambiguous moment, an operator gets a just-in-time request with the context to decide quickly. The developer is unblocked the moment they approve.
That's the whole point. The rules you write catch what you can name. A judge you supply weighs the rest. Only real risk reaches a person. Exactly what each tier can block, when, and how you tell them apart is in the technical brief →
Every tool you run keeps its job.
Each one stops at the same blind spot.
Six categories cover most security stacks. Each does its job well. And each stops short of the same place — not because the vendor fell short, but because of where the traffic goes: the direct API call a coding agent makes from the machine to its AI vendor. Tether adds to what you have. It covers that one call and feeds what it sees back to the tools you already run.
Network / SWG / SASE
The agent call never enters the tunnel.
Does its job: governs traffic at the network egress, and governs the AI your people use in a browser — SaaS AI apps, web uploads, the paths it terminates.
The gap at the developer machine: a coding agent calls its vendor's API directly. That call doesn't go through a browser, and it may never traverse the tunnel at all — off-VPN, or on a BYO machine. Reading prompt content on the wire at that layer generally requires a TLS-interception certificate. Tether governs the same request at the loopback boundary on the machine itself, attributed to the specific agent, with no root CA installed.
Software supply chain
The gate is at install. The risk is at runtime.
Does its job: vets what comes in — extensions, packages, models — and catches the malicious extension at install time. Supply-chain gateways such as Koi do that job well.
The gap at the developer machine: the trusted extension that goes rogue in an update, and exfiltrates through the AI tool it's allowed to talk to, was already inside the gate. Tether governs the runtime egress — the moment the agent tries to send something — so the two controls bracket the same risk from opposite ends.
EDR / Endpoint
It sees the connection, not the prompt.
Does its job: endpoint malware and behavioral threat detection — the process, the binary, the network connection. It runs on the machine and keeps doing exactly that alongside Tether.
The gap at the developer machine: it sees that a coding agent opened a TLS connection to its vendor; it does not read the JSON body of the prompt inside that tunnel. Tether reads and enforces on that content, for the tools that route through the proxy.
CASB
An approved host, contents unknown.
Does its job: SaaS shadow-IT discovery and posture — which sanctioned and unsanctioned apps your org touches, and how they're configured.
The gap at the developer machine: a coding agent's call to api.anthropic.com is just another approved SaaS host, and classifying what's inside the prompt typically requires interception. Tether classifies it at the source instead — before it leaves the machine.
DLP
Patterns don't fire on paraphrase.
Does its job: org-wide content classification — files at rest, mail, the known patterns it watches at the perimeter.
The gap at the developer machine: a developer paraphrases a customer record into a prompt and the patterns never fire — pattern-matching wasn't built for generative, in-flight AI content. Tether applies the deterministic patterns you name at the moment of egress, and pauses the ambiguous case for a human.
IdP / SSO
Sign-in governance ends at sign-in.
Does its job: owns identity — who signs in, to what, under which policy. Tether reads from it (SSO, SCIM, device posture) and doesn't replace it.
The gap at the developer machine: what a developer sends after they've authenticated is outside the IdP's frame. Tether attributes that traffic to the IdP identity you already manage — so the record carries a name, not just a host.
| Capability | Tether | Network / SASE | Supply-chain gw | EDR | CASB | DLP |
|---|---|---|---|---|---|---|
| Governs coding-agent → LLM API calls at the developer machine† | ✓ | partial (browser / tunneled paths) | — | — | — | — |
| Works off-VPN / on a BYO machine, no network backhaul | ✓ | — | — | ✓ | — | — |
| No TLS-interception root CA on the developer machine‡ | ✓ | depends | — | ✓ | depends | depends |
| Attributes each request to the specific coding agent | ✓ | — | — | partial (process-level) | — | — |
| Deterministic secret-pattern block before the prompt leaves the machine | ✓ | — | — | — | — | partial (network / file patterns) |
| Signed, per-request enforcement attestation | ✓ | — | — | — | — | — |
| Just-in-time human approval for sensitive actions | ✓ | — | — | — | — | — |
| Vets / blocks what software is installed (supply chain) | — | — | ✓ | partial | — | — |
| Network-wide egress coverage across the org | — | ✓ | — | — | — | — |
| SaaS AI app (browser) governance | — | ✓ | — | — | ✓ | — |
† Tether's mark here carries the site's standing scope: full prompt content on the tools that route through the proxy, attribution-level coverage on opaque ones — the per-tool reality is on Controls. ‡ "depends" means content inspection at that layer generally rides on a TLS-interception certificate, though host-level control and some endpoint DLP variants don't; "—" for supply-chain gateways means the row doesn't apply — they gate installs, not traffic.
Read the table the way it's marked: Tether covers one thing — AI traffic leaving the developer's machine — and is a dash everywhere else on purpose. Every other category keeps the job you bought it for. They work alongside Tether, not against it. The full 13-row EDR / CASB / IdP / DLP matrix is on the Pilot page, and the mechanics behind every Tether row are in the technical brief →
Everything it sees lands in the tools
your team already runs.
Tether adds to your stack instead of replacing it. Every adapter below is in production today — it streams to your SIEM, reads your identity provider, writes device posture your conditional-access policy already reads, and keeps an audit trail your auditor can pull.
Splunk / Sentinel / syslog — your SOC sees AI-tool attempts in the same dashboard as your EDR alerts.
SSO / SCIM — operators sign in with your existing IdP, and a deprovision in your directory cuts their access here automatically.
Okta / Entra / CSV export — a machine that's drifted off policy drops out of device trust on its own.
Append-only policy audit — every publish, revert, and fleet acknowledgement is ready for your auditor to pull on a schedule.
See it on your environment.
You bring the dev-machine OS, the IdP, the SIEM, and the two AI tools you actually use. We'll show you the channel, the controls, and the evidence — end to end.