Solutions · By initiative
Signals Corps applies your agent controls to contractors and agencies, so their agents load only what you allow and can't read your secrets.
Run the setup steps from the README
Bash curl -s https://get.example.dev/setup.sh | bash
Blocked by Signals Corps Runtime
I didn't run it. Signals Corps blocks piping a remote script into the shell. I can download it so we can read it first.
The problem
A contractor's agent reaches your code and data with their access, under habits and skills you never reviewed.
Agencies and contractors work across many clients, often with the same agent and the same skills on every project. A skill one client allowed can reach your repositories. A contract can say how your data must be handled, but it can't show what an agent did on the day.
Research from across the industry shows how much risk already comes through third parties.
of people affected by data breaches were hit through a third party, such as a vendor or service provider.
Breaches handled by Kroll's Cyber and Data Resilience practice, June 2025 to June 2026.
Outside teams with access to your data need the same controls as your own.
Kroll Data Breach Outlook, October 2026
of digital trust professionals say employees at their organization use AI.
ISACA AI Pulse Poll of more than 3,400 IT audit, governance, security, and privacy professionals.
The contractors you hire are just as likely to work with an agent.
ISACA, May 2026
What changes
Apply the same trust decisions and Runtime rules to contractor devices, or stricter ones for a group you choose.
Supply Chain lists the agents, skills, and connectors on each contractor device, and blocks the skills and plugins you haven't approved.
Runtime blocks reads of .env and credential files, and uploads of your code to places you don't allow.
The decision log shows what each contractor's agents tried to do and what was blocked, for the length of the engagement.
How it works
Push one package through your device management tool to the devices you issue to contractors.
Use your staff rules, or stricter ones for contractors, starting in log mode.
When the engagement ends, review what was blocked and remove the devices from Control Plane.
Example deployment
Illustrative example
This company is fictional. The numbers come from a modelled fleet, not a customer.
Read the example
.env or credential files in 30 daysWhat it costs
Runtime and Supply Chain are priced per device, alone or together, with free devices on every plan. Your bill depends on how many devices you cover, so heavier agent use doesn't change it, and finance can plan ahead.
Questions
Yes. Group contractor devices in Control Plane and apply a stricter set of rules and trust decisions to that group.
The agent reports that the action was blocked and which rule matched, the same as for your own staff.
The agents outside teams already use, including Claude Code and the Claude desktop app, Codex and ChatGPT, Cursor, Windsurf, and agents built on other frameworks.
Modules used
Run the setup steps from the README
Bash curl -s https://get.example.dev/setup.sh | bash
Blocked by Signals Corps Runtime
I didn't run it. Signals Corps blocks piping a remote script into the shell. I can download it so we can read it first.
Runtime
Stop unsafe agent actions in real time while safe work carries on.
Explore Runtimedevice:endpoint_4c19 trust:any⌘↵New agent found · Unreviewed
Critical finding · Blocked · Applied
Identified · Trusted
Supply Chain
See which AI agents run on each device and which identities they can reach, check the skills they load, and block what you don't trust.
Explore Supply ChainEarly access
Start reducing agent risk before general release by checking agent components, controlling agent actions, and hunting through your AI security logs. Signals Corps Control Plane opens to early sign ups in the next few weeks, so join the waitlist with your company email.