The concept

Agent intent

What the agent is trying to do, and the action it has decided to take next. It exists for a moment, on the endpoint, between the decision and the execution. That moment is the only place the outcome is still open.

In short

Agent intent is what an AI agent is trying to accomplish and the specific action it has decided to take next. It exists on the endpoint in the reasoning chain, in the interval between deciding and executing. Conventional controls observe the artifacts that decision leaves behind (a packet, a syscall, a log entry), by which point the reasoning is gone and the action has already run. Certiv sits at the point of intent, evaluates the tool call semantically against policy, and allows, pauses, steers or blocks it before execution.

One action, read three ways

Every row below is an accurate account of the same event. Two of them are also completely useless for stopping it.

The network sees

An HTTPS request to an approved API endpoint.

Allowed, the destination is on the list.

The OS sees

A signed Python interpreter opening a socket and reading a file.

Allowed, that is what a Python interpreter does.

The agent layer sees

The agent decided to resolve a failing test by reading the production credentials file and posting its contents to a paste service.

Blocked, before the file is opened.

Read, understand, act

Reading intent is not useful on its own. The three steps have to happen in the same place, inside the window before the action executes.

01

Read

Certiv runs on the endpoint, where the agent forms its intent, the prompt, the reasoning chain, the tool it is reaching for and the arguments it is about to pass. None of this exists on the wire, and by the time it reaches the OS it has already collapsed into a syscall.

02

Understand

A tool call is evaluated semantically rather than by pattern. "Read a file" is not the question; which file, on whose behalf, in service of what goal, and whether that goal is the one the session started with. Drift from the original task is itself a signal.

03

Act

The decision lands while the action is still a request. Policy allows, pauses for approval, steers, or blocks. That happens before execution rather than after the fact, which is the only point at which the outcome is still open.

Why nothing else catches it

Traditional tools were built for humans, not agents. Network proxies see packets, not reasoning. EDR monitors system calls, not intent. CASB covers browser SaaS, and agents bypass it via APIs.

None of that is a defect in those tools. It is a consequence of where they sit. An agent's decision is fully formed and then discarded before it ever reaches a wire or a syscall. What arrives at those layers is the residue, and the residue looks legitimate because it was produced by software that is allowed to run.

To secure a tool call before it happens, you have to sit where the agent forms its intent.

Straight Answers

Agent Intent, Explained

Expand to view common questions.

What is agent intent?
What an AI agent is trying to accomplish, and the specific action it has decided to take next in service of that goal. It exists on the endpoint, in the reasoning chain, in the moment between the agent deciding and the system executing. Traditional controls observe the artifacts that decision leaves behind (a packet, a syscall, a log line) rather than the decision itself.
Why can existing tools not see intent?
They are watching the wrong layer, and correctly so for their own purpose. Network proxies see packets, not reasoning. EDR monitors system calls, not intent. CASB covers browser SaaS, and agents bypass it via APIs. None of them can see what an agent is thinking or about to do, because by the time an action reaches those layers the reasoning that produced it is gone.
Is this just prompt logging?
No. A log tells you about the damage once it is done. Reading intent means evaluating the action while it is still a request. The tool call, its arguments and the goal behind it are checked against policy, and anything that breaches it never executes. Logging is the record; intent-based enforcement is the decision.
What is intent drift?
When the actions an agent takes stop serving the task it was given. An agent asked to fix a failing test that begins reading credentials has drifted, even though every individual action may be permitted. Because Certiv holds the session goal alongside each action, that divergence is visible as a signal rather than as a series of individually reasonable steps.

See Certiv on Your Own Endpoints

Deploy in minutes. See every agent, then control what happens next.

Book a Demo

Keep reading

Our approach

The full thesis: read intent, detect drift, enforce before execution.

Where Certiv fits

The layer intent lives at, and the controls sitting above and below it.

Pre-execution enforcement

What it takes to decide while the action is still a request.