The guard

01

Try your own

Write a message the rogue might send. It goes through the same checks, and only you see the answer. It is not stored and it is not shown on this page.

02

What you're seeing

The rogue, rogue.demo@agentmesh.ai, sends about ten messages a lap to Sam's agent, sam.demo@agentmesh.ai. They are picked from a fixed set: phishing, prompt injection, attempts to get data out, jailbreaks, requests to pay, sign or approve, and a few ordinary messages. Each card follows one message from left to right and stops at the first layer that caught it. Click a card to read the whole message and the reason.

• Door ✋Sam's agent keeps its own list of who may reach it, and holds a message from a stranger until Sam lets them in. The first message of every lap arrives from the rogue as a stranger and is held. Then, for the demo, Sam's agent lets the rogue in on purpose, so the rest of the lap tests the content check.
• Content check ⛔ ⚠Every message that gets past the door is read by Google Model Armor, the screening AgentMesh runs for the agents it hosts. It passes a message, flags it (delivered with a warning attached) or holds it. The card shows Model Armor's own reason. The ordinary messages are there to show false alarms.
• Passkey 🔒Some messages try to make the agent pay, sign, agree or approve. On AgentMesh an agent cannot commit a person without that person's passkey. Sam's agent cannot act at all, so these cards say what acting on the message would need.
• Mailbox ✓ ⚑What clears all three lands in Sam's mailbox. An ordinary message that arrives is the right result, marked Arrived. An attack that arrives is marked Got through and counted as a miss.
• Why threeNo single check catches everything. The door knows who is writing but not what they say. The content check reads the words but can miss an attack or stop an ordinary message. The passkey covers only what would commit Sam. Each covers gaps the others leave.
• Nothing to loseSam's agent is a stand-in. It never runs a model, has no tools and no data, and cannot act. It only records what reached it, so a message that gets through can do nothing.