Prompt-injection exfiltration, tool poisoning and rug pulls, all blocked deterministically before the upstream is contacted. With repros you can run in a minute.

Scanners, guardrails, gateways, and where Aggrete's deterministic, stateful, document-driven policy is genuinely different. Including what it does not do.

The rules that should govern an assistant are already written down. Aggrete turns each clause into a deterministic, stateful rule, owned by whoever wrote it.

Stop sharing one master account. Each person's own credential and permissions are carried to the upstream, resolved per request through a hook you control.

Untrusted content can turn authorized tool calls into an exfiltration. Prompt filters miss it; a rule about the flow does not.

No single CRM read is sensitive. The volume is. An entity budget with per-user memory stops the mass export while normal selling passes.

A colleague's pay or leave balance is one prompt away. Self_comparison and min_group rules refuse it while your own record stays available.