Onyx Security launches with $40M to solve the trust gap in autonomous agents through semantic-layer reasoning monitoring.
Why autonomous agents need a control plane
Autonomous agents do more than answer questions. They plan multi-step work, call tools, read data, and act on external systems. That reach creates a trust gap: teams can see inputs and final outputs, but they often cannot see whether the agent’s intermediate reasoning stayed within policy, used tools as intended, or drifted into unsafe actions. A secure AI control plane sits between the agent and the systems it can touch. It decides what the agent may do, observes how it reasons toward those actions, and can block, escalate, or log decisions before damage lands in production.
Traditional application security focuses on APIs, identity, and network boundaries. Those layers still matter, but they miss agent-specific failure modes: a model that “helpfully” over-scopes a tool call, chains privileges across services, or follows a malicious prompt that looks legitimate in raw text. Control-plane design for agents has to treat reasoning and intent as first-class signals, not afterthoughts bolted onto request logs.
What Onyx Security is putting forward
Onyx Security is launching as a secure AI control plane aimed at that gap. The company has raised $40M and centers its approach on semantic-layer reasoning monitoring: watching not only which tools were invoked, but what the agent appears to be trying to accomplish and whether that intent aligns with allowed policy. Semantic monitoring operates above token streams and API traces. It interprets plans, tool arguments, and intermediate conclusions in terms of meaning—scope, data sensitivity, side effects—so policy can be enforced on goals and actions rather than brittle string matches alone.
That framing is useful even if you never adopt a single vendor. Any serious agent deployment needs an explicit place where “allowed goals,” “allowed tools,” and “allowed data classes” are defined and checked continuously. Funding and product packaging change over time; the architectural need for a mediation layer does not.
Semantic-layer monitoring in practice
At a practical level, semantic-layer monitoring means evaluating agent steps against a model of what safe work looks like in your environment. A step that summarizes a public doc is different from one that exports customer records or changes infrastructure. The control plane should classify proposed actions by impact, attach them to the agent’s stated or inferred objective, and compare both to policy. When the match is weak—wrong data class, unexpected tool, privilege jump—the plane should halt or require human approval rather than hoping post-hoc audit catches it.
- Define goals and tool scopes in plain policy language before agents run in production.
- Log reasoning summaries and tool intents with enough structure to reconstruct why an action was allowed or denied.
- Fail closed on high-impact actions when semantic confidence or policy match is low.
- Separate “model output” from “authorized execution” so generation never equals permission.
How teams should evaluate a control plane
When you assess Onyx Security or any peer approach, test integration points more than marketing claims. Can you attach the plane to your existing agent runtime without rewriting every tool? Does policy cover multi-agent handoffs, not only single-model chats? Can security and platform teams express rules without reverse-engineering prompt templates? Measure latency and false-block rates on real workflows: a control plane that is too slow or too noisy will be bypassed, which recreates the trust gap it was meant to close.
Start with a narrow blast radius: one agent, a fixed tool set, and clear high-risk actions that must never run unattended. Instrument denials and overrides so you learn where policy is wrong versus where the agent is unsafe. Expand only when you can explain, from control-plane records alone, what the agent intended, what it tried, and why it was permitted. That audit trail is the practical answer to the trust gap—more than any single product launch—because it turns agent autonomy into something operators can govern, not just hope for.