AI Runtime Protection

Everything that happens once an agent starts working. The prompt, the response, every tool call, the tool response, the files accessed, and the skills and sub-agents invoked. Island reads the full content of each rather than a metadata summary.

A component of the Island Enterprise Agentic Control Plane that governs what an AI agent does once it starts working. It reads the full content of every prompt, response, tool call, tool response, file action, skill, and sub-agent, catches threats such as prompt injection inline, and acts on them by policy at every control point an agent can touch.

It acts. Attempted exfiltration or an unintended destructive action leads to prevention, context returned to the agent explaining why, and a log entry for the administrator.

The agent gets told why and keeps working within the boundary. Most tools return an error code and end the interaction.

Traditional data loss prevention (DLP) watches content moving between a person and an application. AI Runtime Protection reads the whole sequence an agent runs, including tool calls and tool responses that never look like a data transfer, and connects steps that separate tools each log as low severity.

Prompt injection, jailbreak, agent drift, malicious URLs, malicious MCP servers, data leakage, and unwanted content.

Island built the classifiers as small, single-purpose models trained for one threat type each, rather than routing every check through a general-purpose LLM. That design keeps them fast enough to sit inline.

AI Runtime Protection applies one central policy across the Island Enterprise Browser, the Island Extension (for Chrome, Microsoft Edge, Firefox, and Safari), Island Desktop, and agent hooks. The same policy covers Model Context Protocol (MCP) traffic through the Island MCP Gateway, Island Network inspection through the secure web gateway (SWG), large language model (LLM) gateway integrations, AI provider compliance application programming interfaces (APIs), OpenTelemetry ingestion, and local activity collection. The browser, the extension, agent hooks, the MCP Gateway, network inspection, and LLM gateways that call Island synchronously all sit inline, so they can stop an action before it happens. Provider APIs, OpenTelemetry, and local collection report after the event and feed the same audit trail and alerts.

Island integrates directly with Claude Code, Claude Cowork, Codex, and Cursor through hook integrations. Those hooks let Island inspect a prompt before it reaches the model and a tool call before it runs, and deny either one wherever the application exposes that event. After a tool runs, Island can withhold its result, or replace it on hosts that support replacement, before the model reads it. Other agents can send events to Island's API and act on the verdict it returns.

Island covers them in two ways. The agent hook integrations read prompts and tool calls in plain text before the application sends them, so the network connection stays encrypted. Desktop AI clients, AI browser extensions that call a model directly, local models, and scripts that call a provider's API or software development kit (SDK) can route through Island Network inspection instead. Traffic reaches it from Island Desktop, an explicit proxy, or a transparent tunnel or connector on-ramp. That path inspects compatible requests before the provider receives them, on or off the corporate network, while the device stays connected to Island. Transport Layer Security (TLS) inspection requires the device to trust Island's certificate.

Supported Microsoft 365 web applications run through browser or network inspection, and native Microsoft 365 applications can use compatible network inspection. For enterprise AI accounts, Island's provider integrations retrieve interaction records from ChatGPT Enterprise, from Claude through the Claude Compliance API, and from Microsoft Copilot. Island also ingests OpenTelemetry data and Amazon Bedrock invocation logs. These sources report after the fact. They add audit coverage and alerts for activity outside Island's inline paths, and each provider integration needs that provider's enterprise licensing and administrator permissions.

Island integrates with LLM gateways such as LiteLLM and Kong and inspects the events the gateway forwards to it. When the gateway calls Island synchronously and honors the verdict, the decision applies inline, and model and version allowlisting applies wherever the gateway exposes those values. Applications can also call Island's API directly, and supported integrations handle streaming model traffic.

A firewall or gateway inspects the traffic routed through it, one request at a time. AI Runtime Protection runs at the gateway too, through the Island MCP Gateway and LLM gateway integrations, and adds what a gateway cannot see: the browser session, the files an agent touched on the endpoint, and the tool calls before and after, all tied to one identity. Each verdict draws on the whole session, and one policy engine applies at every control point.

The same runtime integrations work in development, test, staging, and continuous integration (CI) environments, including cloud workloads, through network or gateway inspection and supported hooks. Background and scheduled agent runs get the same inspection when they use a connected path. On Linux, Island covers activity through network inspection and separately installed hooks.

Island's data loss prevention (DLP) detectors find personal data, payment data, secrets, and source code, along with regional identifiers such as International Bank Account Numbers (IBANs) and national identification numbers. Organizations can add their own data types, match exact values from their own records, and fingerprint documents. Where a control point can read a Microsoft Purview sensitivity label, policy can use the label alongside the detectors, and semantic classifiers complement the patterns, labels, and exact matches. Administrators can tune DLP sensitivity for supported data types.