Skip to content

How Harkaq works

Harkaq puts each AI agent in an isolated workspace with no credentials and routes everything that leaves through a single gateway, which checks each action, injects keys the agent never sees and logs everything. Anything outside the policy is approved by someone else, and what the agent produces reaches production labeled and reviewed.

Talk to us about a pilot
How Harkaq worksThe developer and the agent work in an isolated workspace with no keys. Everything that leaves goes through the gateway, which checks the action, scans for secrets, injects the key and logs everything. Only approved destinations are reachable; everything else is blocked. Security and approvers decide from the console, and what reaches production is labeled and approved by someone else.Isolated workspaceWhere the person and the agent workDeveloperAI agentClaude Code, Codex or otherNo keys or passwordsNo direct internet accesseverything that leavesGatewaythe only way out1 Checks the action2 Scans for secrets3 Injects the key4 Logs everythingIf it can’t bechecked, it doesn’t leaveKey vaultConsolePolicy · approvals · evidenceSecurity and approversThe requester never approvesAI modelIn your account and regionCode repositoryAgent branches onlyApproved packagesOnly the project’s allowlistInternal APIsOnly permitted actionsAny other destinationBlocked and loggedProductionArrives labeled asAI-assisted, and onlywith approval fromsomeone else

1. The cell: where the agent works

Each session opens a fresh workspace that is discarded when it ends. The code, the terminal and the agent live there, and it feels like the developer’s own machine.

  • No passwords or model keys. There are no secrets inside: if the agent is tricked, there is nothing to steal.
  • No direct way out. The workspace can only talk to the gateway.
  • Separated from other workspaces and from the company’s systems.
  • Work is kept; whatever the agent hides is not. When the session closes, anything that could run unnoticed next time is cleaned up.

2. The gateway: the only way out

Everything that leaves the workspace goes through the gateway. For each request it:

  1. Identifies who is asking and from which workspace.
  2. Checks whether that specific action is allowed. A known destination isn’t enough: pushing an agent branch is allowed, deleting the main branch is not.
  3. Scans everything that leaves for passwords or hidden data, including headers and file names.
  4. Injects the key on the way out, without the agent seeing it.
  5. Logs everything in a hash-chained log that can’t be edited without it showing.

If it can’t be checked, it doesn’t leave. When something is blocked, the agent gets a clear message saying what was attempted and why it wasn’t allowed, and it suggests the permitted path.

3. Approvals: someone else decides

If the agent needs something outside the policy, such as downloading a package that isn’t on the project’s list, it asks. The request goes to someone else’s inbox, never to the requester.

  • The approver sees the exact URL, the file hash and the reason the agent gave, and can see what the model had read before asking.
  • The permission is single-use, tied to that session, and expires on its own.
  • Who asked, who approved and why are all logged.

4. What reaches production

The agent can only push its changes to its own branches. Each change arrives in the pull request labeled as AI-assisted with a risk summary for the reviewer, and it only reaches the main branch if someone else approves it.

If the agent changes the project’s instructions during a session, such as AGENTS.md or CLAUDE.md, the next session shows the change and flags it when it asks for something that would repeat in every session.

5. The Security console

Security sets the policy once for every agent and sees each action in a log filterable by project, person, agent and outcome. The audit evidence report is one click away: it verifies the log’s chain and declares what is pending instead of hiding it.

Frequently asked questions

Which AI agents work with Harkaq?

Today, Claude Code and Codex, under the same policy. Harkaq works with agents that let you route their model connection; adding a new one doesn’t mean approving everything again.

Do developers have to change how they work?

No. They open their workspace in the browser and find the editor, terminal and agent just like on their own machine. If they don’t need to decide anything, they see no security prompts.

Where does the AI model run?

In your company’s cloud account and in the region you choose, where your provider allows it. The gateway signs each model call; the agent never holds the key.

What happens if the agent falls for a prompt injection?

It may try whatever the injection asks, but it has no credentials to hand over and no direct way out: the gateway blocks any unapproved destination, logs it and alerts Security.

Try it with one of your teams

A pilot with a real team and repository, goals agreed before we start, and an evidence report at the end. You decide on results, not on a slide deck.

Talk to us about a pilotHow the pilot works