Skip to main content

Watchlight AI Enclave

Run an agent in a box it can't talk its way out of, and get evidence your security review can check offline.

You hand an agent a repo and a task. It can edit files, call tools, and reach the network. Two questions follow immediately, and neither is answerable after the fact by reading logs the agent could have written:

  • What did it actually try to reach?
  • What was it allowed to do, and who decided?

Enclave runs the agent in an isolated sandbox whose only route out is a recording egress guard, then seals what happened into a hash-chained evidence bundle. Anyone can check that bundle without an account, without the network, and without trusting you.

pip install watchlight-enclave
wl-enclave init                          # writes enclave.yaml, scaffolds a policy
wl-enclave keygen                        # one key, once; runs seal signed bundles
wl-enclave run --purpose "Fix PR #412"   # runs the agent in a sandbox
wl-enclave verify runs/<id>/bundle       # checks the evidence, offline
wl-enclave hosts --since 2026-11-03      # what did it actually reach?

What did it reach?​

The question a security review opens with. The answer comes out of verified bundles, not out of the agent's own logs:

$ wl-enclave hosts --since 2026-11-03
wl-enclave: runs     14 verified
wl-enclave: coverage http_connect only; icmp, raw_tcp, udp had no route and are not recorded

HOST                          PORT  VERDICT TRIES      SENT      RECV  LAST IP
pastebin.com                   443  deny       20         -         -  -
example.com                    443  allow      20   34.4 kB  128.2 kB  172.66.147.243

wl-enclave: 2 host/verdict pair(s) over 40 attempt(s)

If a run's bundle doesn't verify, its hosts are left out of that table and the count above it says so. A short host list is the one way this command could mislead you, so it refuses to be quietly short.

The one rule​

A bundle must never be able to understate what happened.

A bundle that quietly drops records while still looking complete is worse than one that admits a gap. The first gets a reviewer to sign off; the second gets them to ask a question. That's why verify gives four answers instead of two:

VerdictWhat it means
failedThe chain is broken. Don't trust the file.
uncontainedThe chain is fine, but isolation slipped. Trust it, and go deal with it.
incompleteEverything here is true, but something might be missing.
okComplete and intact. Only ok exits 0.

A verifier that can't tell "this file is lying" from "this file is honest about a gap" leaves you guessing which one you're holding.

Two layers​

The sandbox decides where the agent may connect: an internal network with no route out, and an egress guard that is the only way through.

Watchlight decides what authority the agent has — which tools, on which resources, under whose policy. Standard Cedar, so the policy is readable and the decisions are deterministic.

One doesn't replace the other. Watchlight knows the agent asked to wire money. The guard knows it tried to reach pastebin.com. Neither fact gets you the other one, and a bundle carries both.

Open source​

Enclave is Apache-2.0. The CLI, the enclave.yaml schema, the evidence format and its offline verifier are all open, and the source is on GitHub:

github.com/watchlight-ai-beacon/watchlight-enclave

That matters more here than in most projects. The product's claim is that a skeptical reader can check a bundle without trusting us, which only means something if they can read the verifier that checks it.

Where to next​

The rest of these docs cover installing it, running your first governed agent, reading a bundle, signing and key custody, and the full CLI. They ask for a free account — one email, a magic link, no password.