The Stack
The AI agent control stack has four layers. Each answers a different question. Every tool in the ecosystem lives in one of them.
Layer 1 is crowded. Layer 2 is very crowded — and getting more crowded every week with major players (NVIDIA, Cisco, Microsoft) all building here. Layer 3 is empty. Except for Surfit.
Layer 1: Model — "Is the output safe?"
Smart. These tools make models produce better, safer outputs.
Sleeper agent research has also demonstrated that model-layer safety is fundamentally unreliable — models can be trained to pass all safety evaluations while harboring hidden behaviors. This is a structural limitation of the entire layer.
Layer 2: Runtime — "Is this allowed?"
Safe. These tools sandbox, isolate, and enforce policy on agent runtime.
This layer exploded in March 2026. Major announcements from NVIDIA (NemoClaw at GTC), Cisco (DefenseClaw at RSA), and Microsoft (Agent 365). The pattern: sandbox the agent, control access, enforce static policy.
Every tool in Layer 2 answers the same question: "Is this allowed?" They check permissions, enforce policy, sandbox execution, manage identity. These are important. But they all end the same way: the agent passes the check, and executes on its own.
Layer 3: Decision — "Should this happen right now?"
Correct. This is where business decisions about agent actions are made.
Every tool in Layer 1 makes models smarter. Every tool in Layer 2 makes agents safer to run. Surfit is where those agents go when they need to actually do something.
The agent proposes an action. Surfit evaluates business context — not just whether it's permitted by policy, but whether it's the right action for the organization right now. Timing. Risk. Downstream impact. Organizational state. These are not things a policy file can encode.
Low-risk actions execute instantly. High-risk actions are held and routed for context. Everything produces a receipt. The agent never executes directly — Surfit controls the execution path.
This is not another policy engine. This is not another sandbox. This is not another access control tool. This is the layer where business decisions about agent actions are actually made — and enforced.
The Pattern
Every tool in this landscape is valuable. Every one solves a real problem. And every one ends the same way:
Guardrails validates the output. The agent still executes on its own.
CTGT constrains the model. The agent still executes on its own.
IronCurtain enforces policy. The agent still executes on its own.
NemoClaw sandboxes the runtime. The agent still executes on its own.
Cisco DefenseClaw scans and verifies. The agent still executes on its own.
Microsoft Agent 365 tracks identity. The agent still executes on its own.
CrowdStrike secures infrastructure. The agent still executes on its own.
Surfit is where that changes. The agent proposes. Surfit evaluates the business context. Surfit decides. Surfit executes. The agent never touches the system without Surfit in the path.
Why This Matters Now
Every new tool in Layer 1 and Layer 2 makes agents more capable and safer to run. More capable agents touching more systems means more need for Layer 3.
Every competitor in this landscape is building the case for Surfit without knowing it.
The more agents can do, the more important it becomes to have a layer that evaluates whether they should. That's not safety. That's not compliance. That's business judgment at the point of execution.
Smart. Safe. Correct.
Everyone is building the first two. Surfit is the third.
See how Surfit operates across multiple systems — evaluating, routing, and receipting agent actions in real time.
Watch the Demo