LockStock Guard Documentation

Overview

LockStock Guard is an enterprise-grade security layer that provides real-time monitoring, anomaly detection, and causal auditing for autonomous AI agents. Unlike traditional security tools that rely on timestamps and log correlation, Guard uses cryptographic proof and topology analysis to create an immutable record of agent behavior.

                The Core Insight: In the age of autonomous AI, execution is asynchronous,
                distributed, and non-deterministic. Traditional log analysis breaks down when agents spawn
                sub-processes across different regions. Guard abandons reliance on server clocks and instead
                uses causal graph auditing to prove mathematically that every action follows from its
                predecessor.
            

Key Capabilities

Real-Time Velocity Monitoring - Detect rogue agents by measuring sequence velocity (Δseq/Δtime)
Causal Graph Auditing - Cryptographic chain of custody for every agent decision
Topology Visualization - Visual family tree showing decision lineage from user prompt to final action
Circuit Breaker Architecture - Automatic lockdown when velocity thresholds are exceeded
Compliance-Ready Exports - SOC2, HIPAA, and PCI DSS formatted audit reports
Sidecar Deployment - Less than 5ms latency overhead

Causal Graph Auditing

Traditional logs tell you when something happened. Guard proves why it happened by creating an unbreakable cryptographic chain linking every action to its cause.

How It Works

Every agent action is cryptographically chained to its predecessor using parent hash references. This creates a directed acyclic graph (DAG) where:

Every node is a state transition - Agent moved from state S₁₂ to S₁₃
Every edge is a causal relationship - S₁₃ was caused by S₁₂
The chain is immutable - You cannot delete a record without breaking the cryptographic chain
Server-side timestamps attest - Verifier adds trusted timestamps after validating the sequence

# Traditional Log Entry (Can be spoofed)
[2026-01-15 14:32:01] Agent A: TRANSFER_FUNDS($10,000)

# LockStock Guard Audit Entry (Cryptographically Proven)
{
  "sequence": 45,
  "agent_id": "production-agent-001",
  "task": "TRANSFER_FUNDS",
  "parent_hash": "a7f3c2d1b9e8f4a6...",
  "hash": "3d9e4f2c8b7a1f5d...",
  "server_timestamp": "2026-01-15T14:32:01.234Z",
  "causal_chain": [
    "USER_PROMPT: Process monthly payroll",
    "SUB_AGENT: AUTHENTICATE_USER",
    "SUB_AGENT: VERIFY_BALANCE",
    "SUB_AGENT: TRANSFER_FUNDS"  ← We are here
  ]
}
            

Audit-Ready: Export reports formatted for SOC2, HIPAA, and PCI DSS auditors that visualize the causal flow of data, proving that no unauthorized divergence occurred.

Real-Time Velocity Anomaly Detection

AI agents can hallucinate. When they do, they don't just make a mistake—they make mistakes at the speed of light. A rogue agent might execute 1,000 erroneous database writes before a human can react.

Semantic Velocity Monitoring

Guard monitors the rate at which agents transition between states (Δseq/Δtime). It establishes a baseline for normal operation and triggers alerts when velocity exceeds safe thresholds.

Metric	Normal Baseline	Warning Threshold	Critical Threshold
State Transitions/sec	2-5 per second	30 per second	50 per second
API Calls/min	10-20 per minute	100 per minute	200 per minute
Database Writes/sec	1-3 per second	20 per second	40 per second

Circuit Breaker Architecture

When velocity exceeds critical thresholds, Guard automatically trips a circuit breaker:

Agent State: LOCKED - All operations blocked until manual review
Incident Report Generated - Full causal chain exported for forensic analysis
Alerts Dispatched - PagerDuty, Slack, email notifications sent
Rollback Available - Restore agent to last known-good state

Example Scenario: Agent "billing-processor-03" suddenly executes 87 TRANSFER_FUNDS operations in 4 seconds. Guard detects velocity of 21.75 transitions/sec, trips circuit breaker, and locks the agent. Forensic analysis reveals the agent entered a hallucination loop due to malformed API response.

Dashboard Topology Visualization

Instead of text-based logs, Guard displays a visual topology graph showing the "family tree" of agent decisions. This lets you trace any transaction back through sub-agents to the original user prompt.

The View

The Guard Dashboard renders a hierarchical graph where:

Gold nodes represent user prompts and initialization events
Cyan nodes represent normal sub-agent operations
Red nodes represent detected anomalies
Edges show causal relationships (parent → child)

The Insight

Click any node to see its complete lineage. For example, clicking on a TRANSFER_FUNDS operation reveals:

USER_PROMPT: "Process monthly payroll" (Seq: 0)
  ↳ SUB-AGENT: AUTHENTICATE_USER (Seq: 1)
    ↳ SUB-SUB-AGENT: VERIFY_2FA_TOKEN (Seq: 2)
  ↳ SUB-AGENT: LOAD_PAYROLL_CONFIG (Seq: 3)
  ↳ SUB-AGENT: VERIFY_ACCOUNT_BALANCE (Seq: 4)
    ↳ SUB-SUB-AGENT: QUERY_BANK_API (Seq: 5)
  ↳ SUB-AGENT: TRANSFER_FUNDS (Seq: 6) ← You are here
            

                Compliance Value: During a security audit, you can prove that a sensitive
                financial transaction originated from an authenticated user prompt, passed through all required
                verification steps, and maintained the integrity of the decision chain.
            

Try Live Demo →

Deployment Architecture

LockStock Guard deploys as a lightweight sidecar container that intercepts agent operations without modifying your existing infrastructure.

Sidecar Pattern

Minimal Latency

Guard adds less than 5ms of latency per operation. Cryptographic verification happens asynchronously, so your agents don't wait.

Zero Code Changes

Integrate via environment variables and SDK initialization. No modifications to your agent logic required.

Horizontal Scaling

Each agent gets its own Guard sidecar. Scale to thousands of agents without performance degradation.

Cloud Agnostic

Works with AWS ECS, Kubernetes, Google Cloud Run, or any container orchestration platform.

Integration Example

# Docker Compose Example
version: '3.8'
services:
  my-ai-agent:
    image: mycompany/ai-agent:latest
    environment:
      - LOCKSTOCK_ENABLED=true
      - LOCKSTOCK_AGENT_ID=production-agent-001
    depends_on:
      - lockstock-guard

  lockstock-guard:
    image: d3cipher/lockstock-guard:latest
    environment:
      - GUARD_MODE=enterprise
      - VELOCITY_THRESHOLD=50
      - DASHBOARD_PORT=8080
    ports:
      - "8080:8080"  # Dashboard access
            

Compliance & Certifications

LockStock Guard is designed to meet the most stringent regulatory requirements for AI systems handling sensitive data.

SOC2 Type II HIPAA Compliant PCI DSS Level 1 GDPR Ready ISO 27001

Audit Features

Immutable Audit Trails - Cryptographically signed logs that cannot be altered
Automated Compliance Reports - One-click export for auditors
Access Control Logging - Who accessed what data, when, and why
Data Lineage Tracking - Full provenance of sensitive information
Retention Policies - Configurable log retention (7 years for financial data)

Continuous Credential Rotation

Compliance frameworks like SOC2 and PCI-DSS require regular credential rotation. Most systems rotate every 30-90 days, creating windows where compromised credentials remain valid.

LockStock eliminates this gap entirely.

                Per-Action Rotation vs Traditional:

                Traditional: Password valid for 90 days → Rotate → New password valid for 90 days

                Compromise window: Up to 90 days of undetected access

                LockStock: New cryptographic proof per action → Instant invalidation

                Compromise window: Zero seconds

What This Means For Your Audit:

Show continuous rotation - Auditors see proof rotating on every request, not quarterly
Eliminate rotation gaps - No "we're overdue for rotation" findings
Reduce audit scope - Zero replay window means fewer compensating controls needed
Lower cyber insurance costs - Demonstrably shorter exposure windows = better rates

Real-World Example: A healthcare AI company passed their HIPAA audit in record time by providing Guard's topology graphs showing that patient data never left encrypted channels and all access originated from authenticated clinical staff prompts.

Enterprise Pricing

LockStock Guard uses tiered pricing designed to scale with your deployment from growing teams to enterprise-scale operations.

Plan	Price	Agents	Audit Retention	Support
Professional	$999/month	Up to 50	1 year	Priority
Enterprise	$2,499/month	Up to 250	7 years	Dedicated + SLA
Enterprise Scale	Custom	250+	7 years	White-glove

Professional Tier ($999/month)

Real-time velocity monitoring (up to 50 agents)
Causal graph auditing
Topology visualization dashboard
SOC2/HIPAA compliance exports
1-year audit retention
Priority support

Enterprise Tier ($2,499/month)

Everything in Professional, plus:
Up to 250 agents
Circuit breaker protection
Enterprise dashboard with SSO/SAML
Custom compliance reports
7-year audit retention
Dedicated support with SLA guarantees

Enterprise Scale (Custom Pricing)

Starts at $2,499/month base
Usage-based pricing for 250+ agents
Volume discounts available
Self-hosted deployment option
Custom integration support
White-glove onboarding

Request Demo →