Optics
Sight Loop
Wrap the agent process, watch outbound connections, and report where they went and how much moved.
Vantio · Architecture · Observe · Enforce · Control · Govern
Observe · Enforce · Control · Govern.
The Vantio control architecture
Observe · Optics. Enforce · Gate. Control · Phantom Engine. Govern · Enterprise. Continuous Assurance is the platform trust loop that verifies the chain. It is not another plan.
Topology
Where each layer sits
The Vantio control architecture
Observe · Optics · Enforce · Gate · Control · Phantom Engine · Govern · Enterprise · Continuous Assurance verifies the chain
Topology
Govern
Enterprise
Owner and authority. Durable evidence, audit records, and dual-control.
Enforce
Gate
Policy Latch. Destination, redaction, and spend rules on the wrap.
Control
Phantom Engine
Host Control on enrolled Linux. Rogue Reconciliation names the gap.
Host
Enrolled Linux host
The machines you enroll. Exact coverage is documented for that deployment.
Observe · Optics
Optics spans supported activity and coverage truth. It reports where wrapped traffic went, and names what still sits outside that watch.
Continuous Assurance
Verifies control state across the chain. Reconciles evidence and keeps known gaps visible. It is not a fifth product.
Named workflows
Sight Loop · Policy Latch · Rogue Reconciliation
Gate
Policy Latch
Write policy as code, preview it on live traffic, then turn enforcement on.
Phantom Engine
Rogue Reconciliation
Compare wrap decisions with host events, and name the gap when they disagree.
Platform layer
Continuous Assurance
Continuous Assurance is the platform trust loop that verifies the chain. It is not another plan. Verify control state, reconcile evidence, and keep known gaps visible.
Data and privacy
What Vantio records — and what it refuses to keep.
Recorded
- DestinationWhere the agent tried to connect
- Process contextWhat ran, under what identity
- Volume & timingHow much moved, and when
- DecisionOBSERVED, ALLOWED, BLOCKED, REDACTED, or a named host gap
- TraceEnough to match events across layers
Never retained
- PromptsUser and system instructions stay out
- CompletionsModel output is not stored in Vantio’s hosted records
- Tool payloads as chatVantio’s hosted records do not build a conversation warehouse
- Customer secrets by designRedaction is a Gate action, not a retention strategy
Why this shape
What we chose on purpose
Identity systems say who. Vantio keeps the constraint real where the agent runs. MCP awareness complements host control; it does not turn Vantio into a generic gateway.
Common pattern
Chat-logging governance
Vantio
Connection and decision records
You get an audit trail without turning every agent session into a liability archive. You cannot replay the prompt from Optics.
Common pattern
Mandatory outbound proxy
Vantio
Rules where the agent already runs
Enforcement attaches to the wrap you run. There is no mandatory proxy hop.
Common pattern
Hope the wrap is always on
Vantio
Independent control on enrolled hosts
When app controls miss a path, the enrolled host still matches evidence and names that gap.
Coverage and limitations
What each layer provides
Product prices live on Pricing. Path status lives on Compatibility.
| Capability | Optics | Gate | Phantom Engine | Enterprise |
|---|---|---|---|---|
| Live watch on supported agent traffic | Yes — report only | Yes | Yes | Yes |
| Action labels | OBSERVED | ALLOWED / BLOCKED / REDACTED | ALLOWED / BLOCKED + named coverage gap | Same + reviewable evidence |
| Policy as code · preview → enforce | — | Yes | Yes (on-prem Gate on that host) | Yes |
| Enforce on the agent path | — | Destination controls, redaction, spend limits | Yes (on-prem Gate) | Yes |
| Runtime protection on machines you own | — | — | Yes | Governance on Phantom Engine |
| Rogue Reconciliation | — | Report names gaps Gate cannot see | Correlates app-path decisions with host events | Same + durable correlated evidence |
| Durable evidence · audit records · dual-control | — | — | — | Yes |
| Multi-tenant cloud control plane | — | Hosted Gate control plane | Not offered for the host stop | Not offered for the host stop |