Where Chock sits

How to read this page

Each layer below opens with what that class of product controls and what Chock controls. Then come the two directions: what the layer can catch that Chock can't, and what Chock can catch that the layer can't. Last come examples of products in the layer, each quoting one sentence from the vendor's own page, with the date we last found that sentence there. The quotes are the vendors' words: we have not tested any of these products. Chock's claims quote chock's own docs at the pinned engine commit, and the end of the page shows those sections in full. What Chock can enforce differs per agent: each agent's tier and grade

Agent identity

What this layer controls

Agent identity products give each AI agent an account of its own and decide what it may reach: which apps, data, tools and other agents, with which tokens, across a whole organisation.

Chock controls what an agent does inside one repository. That repository's policies check the agent's tool calls and commits there, whatever identity the agent runs as.

What this layer catches that Chock can't

Who an agent is, and what it may reach: tokens, apps, data and other agents, across a whole organisation. Taking one agent's access away everywhere at once. Chock's docs list agent identity and tokens among what Chock does not do.

Agent identity, tokens, and spend budgets.

Chock's docs, docs/agentic-risk-coverage.md: What Chock does not do — stated plainly

Identity platforms and gateways own runtime credentials and quotas.

Chock's docs, docs/agentic-risk-coverage.md: What Chock does not do — stated plainly

What Chock catches that this layer can't

A wrong move made with access the agent already has. An agent with valid rights to a repository can still make a commit that breaks one of the repository's policies. At the commit tier, Chock's git hook or CI gate refuses that commit, whichever identity made it.

commit is a git hook or CI gate that exits non-zero.

Chock's docs, README.md: Guardrails, not guarantees

Examples, in the vendors' words

• Microsoft Entra Agent ID (Microsoft): Agent identities are identity accounts within Microsoft Entra ID that provide unique identification and authentication capabilities for AI agents. Source: Microsoft, as of 2026-10-26.
• Microsoft Agent 365 (Microsoft): Enforce least-privilege access by controlling which users, data, and tools or MCP servers agents can use. Source: Microsoft, as of 2026-10-26.
• SailPoint Agentic Fabric (SailPoint): New Just-in-Time (JIT) provisioning with conditions, plus effective privilege visibility, replaces always-on access for people, service accounts, and AI agents alike. Source: SailPoint, as of 2026-10-16.

OS containment

What this layer controls

OS containment products run an agent's process inside a boundary the agent cannot change: which files it may read or write, and which network destinations it may reach.

Chock controls what the agent does with the access it has inside that boundary: whether a change to the repository is one the repository's policies allow.

What this layer catches that Chock can't

Every file and network access by the agent's process and what it starts, whether or not the action passes through a hook. Chock sees an action in the agent when the agent's hook hands it over, and its docs grade that tier best-effort.

in-agent is the agent's pre-tool hook: best-effort, and it fails open.

Chock's docs, README.md: Guardrails, not guarantees

What Chock catches that this layer can't

A wrong move inside the boundary. A coding agent usually has read and write access to its repository. Inside that access, Chock's policies check each commit, and at the commit tier the gate refuses one that breaks a policy.

commit is a git hook or CI gate that exits non-zero.

Chock's docs, README.md: Guardrails, not guarantees

Examples, in the vendors' words

• Microsoft Execution Containers (MXC) (Microsoft): The policy remains outside the agent workload’s control, so the agent or generated code cannot grant itself additional access. Source: Microsoft, as of 2026-10-26.

Gateways

What this layer controls

Gateways sit in the path of an agent's traffic: model calls, MCP tool calls and outbound requests routed through them are allowed, denied or sent for review under one central policy.

Chock controls the repository end: its hooks and CI gate check a change whether or not the agent's traffic went through a gateway.

What this layer catches that Chock can't

Model calls, outbound network requests and MCP tool calls, for any agent whose traffic is routed through the gateway, under one central policy. Chock's docs leave runtime credentials and quotas to gateways.

Identity platforms and gateways own runtime credentials and quotas.

Chock's docs, docs/agentic-risk-coverage.md: What Chock does not do — stated plainly

What Chock catches that this layer can't

Actions that never pass a gateway. Chock compiles its controls into the agent's own hooks, git hooks and a CI gate in the repository. So the git hook or CI checks a commit whether or not the agent's traffic went through a gateway.

Chock models nine: ambient-rule, git-hook, ci-gate, pre-tool-use, stop, agent-hooks, managed-setting, gateway, mcp-gateway.

Chock's docs, docs/concepts.md: Enforcement surface

commit is a git hook or CI gate that exits non-zero.

Chock's docs, README.md: Guardrails, not guarantees

Examples, in the vendors' words

• Transcend Rails (Transcend): Every decision resolves to allow, deny or escalate, and an escalated action waits for a named reviewer before it proceeds. Source: Transcend, as of 2026-10-26.

Inventory and monitoring

What this layer controls

Inventory and monitoring products list the agents an organisation runs across many platforms, with each agent's owner, cost, performance and approval status.

Chock controls single actions as they happen, in each repository it is installed in.

What this layer catches that Chock can't

Which agents exist across many platforms, who owns them, what they cost, how they perform, and which are approved. Chock works inside each repository it is installed in: a policy is a folder in that repository.

A policy is a self-contained folder under .agents/policies/<id>/

Chock's docs, docs/concepts.md: Policy

What Chock catches that this layer can't

The action itself, at the moment it happens. An inventory records which agents exist, who owns them and which are approved. Chock's gate decides on the commit, and on supported agents on the tool call, before it lands or runs.

commit is a git hook or CI gate that exits non-zero. in-agent is the agent's pre-tool hook: best-effort, and it fails open.

Chock's docs, README.md: Guardrails, not guarantees

Examples, in the vendors' words

• Dataiku Agent Management (Dataiku): It does not operate your agents or step into their decisions, so they keep running exactly as your teams built them. Source: Dataiku, as of 2026-10-26.
• SAP AI agent hub (SAP LeanIX) (SAP): Next, you can monitor AI agents’ status throughout their lifecycle to help ensure only approved agents are deployed to your IT landscape. Source: SAP, as of 2026-10-26.

Browser and edge

What this layer controls

Browser and edge products govern what people and agents do in the browser, on the device and on the network, including on devices an organisation does not manage.

Chock controls changes to a repository, checked against that repository's own policies.

What this layer catches that Chock can't

What people and agents do in the browser, on the device and on the network: data leaving through a web app, a risky extension, device posture, and policy on devices an organisation does not manage. None of Chock's hook points is a browser or an endpoint agent, and its docs leave endpoint watching to EDR products.

Chock models nine: ambient-rule, git-hook, ci-gate, pre-tool-use, stop, agent-hooks, managed-setting, gateway, mcp-gateway.

Chock's docs, docs/concepts.md: Enforcement surface

Watching an agent after the fact is an EDR product's job

Chock's docs, docs/agentic-risk-coverage.md: What Chock does not do — stated plainly

What Chock catches that this layer can't

A change checked in the repository itself. Where a repository runs Chock's CI gate, it checks the pushed commits there, whichever browser, device or network they came from.

commit is a git hook or CI gate that exits non-zero.

Chock's docs, README.md: Guardrails, not guarantees

Examples, in the vendors' words

• Island (Island): Island sits where AI is used: browser, endpoint, network, every tool call. Source: Island, as of 2026-10-26.

Use chock alongside these layers

Chock works alongside these layers. It replaces none of them.