a company · est. 2026

Enforcement infrastructure for the agent era.

Lictorate builds the runtime layer between AI agents and the systems they touch. Our first product, Vanzik (formerly AgentGuard), is an open-source firewall that checks every tool call against policy before it runs.

Meet Vanzik Read the thesis

Apache 2.0open-source core

0.53 msp99 policy decision

v2.0Vanzik, shipping

thesis

The trust boundary moved, and almost no one is guarding it.

For thirty years, the line between human intent and system action sat at the keyboard. Models with tools removed the gap. The security model has not caught up.

01 / OBSERVATION

Agents act, not suggest.

Tool calls. Browser control. Code execution. The agent reads, decides, and reaches into real systems in the same loop, with no person between the intent and the consequence.

02 / GAP

Detection is too late.

Audit logs and evals record what already cost you something. An audit without enforcement is a confession, not a control. Agents need a firewall, not just an IDS.

03 / WHERE WE FIT

The runtime is where authority lives.

Not the model. Not the prompt. Not the framework. The line must hold in the runtime: deterministic, auditable, and unable to be argued with by a long enough message.

principles

Three rules we hold to. They shape every API, default, and release.

I.
Authority before action.
Policy precedes action. No model output reaches a tool until the rules permit it. Not after. Not in parallel.
II.
Defense in depth.
One prompt injection should not be catastrophic. Enforcement is the layer that contains the blast radius when alignment fails.
III.
Auditable enforcement.
Every decision visible. Every rule reviewable. Security teams should read code, not hope.

Read the full thesis

what we ship

One product, deeply. The runtime first.

Lictorate is the company. The products below are how the thesis reaches the world. We start narrow on purpose, and the core stays open, forever.

open source · v2.0.0

Vanzik

open-source runtime firewall for AI agents

Wire-level enforcement at the protocol boundary: put Vanzik on the wire as an MCP gateway or an LLM API proxy, write YAML rules, and every tool call is allowed, denied, or held for human approval at 0.53 ms p99. Stateful, multi-tenant, and audited: zero-config SQLite on a single node, or PostgreSQL for shared state across replicas.

Core: Go 1.26
State: SQLite (single-node) · PostgreSQL (multi-node)
Policy: Multi-tenant YAML
Enforcement: MCP gateway · LLM API proxy · coding-agent hooks · SDKs

Visit Vanzik Read the docs View GitHub

hosted · multi-tenant · in design · waitlist open

Vanzik Cloud

fleet routing, central dashboard, team audit sync

For teams managing multiple agents in production. Shared policy libraries, global rate limits, live action feeds for central human approvals, and exportable SOC-ready audit logs. The core firewall stays open; this is the control plane.

Join the waitlist

who

Fast. Infrastructure-focused. Security-first.

We are deliberately focused on building the enforcement layer for AI agents: the firewall between an agent and the systems it touches. The code, threat model and release history are public, so you can judge the work directly.

Cauã Ferraz· founder · backend & systems

Backend and systems engineer. Started Lictorate to build the enforcement layer the agent stack is missing: the boring, load-bearing kind of infrastructure, the kind you only notice when it isn’t there.

About →Email →GitHub →

Policy precedes action.

lex antecedit actum

That’s the whole company in three words. Vanzik is how it ships today: open source and self-hosted, with a hosted Cloud in design.

Get Vanzik Join the Cloud waitlist