An exposed entry point.
Exploiting Langflow opens the way to reconnaissance and credential collection.
HECTOR / GOVERNING AGENTIC EXECUTIONPROJECT IN DEVELOPMENT · TARGET ARCHITECTURE
From intent
to real-world effect.
An action,
governed.
Qualify, arbitrate, control, trace. HECTOR is designed to govern the full chain of actions and decisions of agentic and autonomous systems, before, during and after execution.
HECTORILLUSTRATIVE PRINCIPLE
PROPOSED ACTIONIsolate a production
service.
- Initiator
- Cyberdefence agent
- Business context
- Critical service
- Expected effect
- Connections interrupted
- Applicable framework
- Reserved approval
‖
Execution waits.
The competent authority must decide.
GOVERNANCE.TRUST.EXECUTABILITY.EVIDENCE.
01 / WHY NOWTHE JADEPUFFER CASE
A CASE DOCUMENTED BY SYSDIGA failure.
A failure.
A correction.
The attack continues.
31s
between a failed connection
and a corrective patch,
according to Sysdig’s analysis.
Sysdig describes JADEPUFFER as an extortion campaign driven by an LLM agent: entry through an exposed Langflow instance, credential discovery, progression to a production database, then destructive operations. The attribution to agentic operation rests on the researchers’ observations and analysis.
An attempt fails.
A corrective patch is issued 31 seconds after the failure; the sequence continues.
A production target.
The campaign progresses to encryption and data destruction operations.
Source: Michael Clark, Sysdig Threat Research Team, 1 July 2026.Read the original analysis ↗
THE ARCHITECTURAL QUESTION
Which action may cross
the threshold of real-world effect?
The problem revealed
An adaptive chain can change its tool, path or syntax while pursuing the same effect. Control must account for the real action, its context and the authority it invokes.
HECTOR’s design response
Connect action qualification to a governance decision, then to executability control at points of effect: check conditions, issue a bounded permit when they are met, observe execution and retain evidence.
Architectural reading: HECTOR was not deployed in the reported case. This analysis explains its positioning; it is neither a test result nor a claim that it would have prevented the incident.
02 / THE FOUNDATIONS OF CONTROLBEFORE · DURING · AFTER
Give every effect
a framework.
Continuous governance,
from the initial context to reconstructing
what was done.
An alert does not yet tell you
what to do.
A cyberdefence agent recommends isolating a service. The technical signal is serious, but that service supports a critical activity. Is the available context sufficient to observe, suspend one connection or stop the entire activity?
THE HECTOR APPROACH
Receive qualified context from existing tools and assess whether it is sufficient for the intended action, accounting for business criticality, system state and available evidence.
THE CONTROL QUESTIONIs the context sufficient for this effect?
03 / MAP AND ENROLFROM AN OBSERVED ENVIRONMENT TO A GOVERNED SPACE
See the agents.
Establish control.
Identify sources, qualify their activity
and build their mediation path.
An agent, orchestrator, MCP server or unknown workload may be visible in the environment without its actions passing through HECTOR. Enrolment makes this boundary explicit: observe, qualify, test in shadow mode, then place under mediation.
VISIBILITY / UNENROLLED SOURCE
A source appears. Its authority remains to be established.
Mapping connects observed sources, their activity and their targets. An unknown workload remains identified as such: discovery is not treated as a verified identity or a controlled action.
OBSERVED ENVIRONMENTVisible source
→MEDIATION BOUNDARYInterception point to qualify
→GOVERNED SPACEControl not established
ONE MAP. THREE VIEWS.
Volume, criticality or connection state.
AGENTS / SOURCES
ORCHESTRATIONBusiness orchestrator
→MEDIATIONGateway / HECTOR Bridge
→TARGET SYSTEMSIdentity · Finance · ERP
SUPPORT AGENT
418 transactions in this example. Volume helps identify the busiest flows; it does not, on its own, determine their criticality.
Simplified representation with fictional data, inspired by design screens. Volumes and statuses do not describe a real deployment.
04 / ACTION CORRIDORSAUTONOMY WITH EXPLICIT LIMITS
ACT QUICKLY WITHIN A DEFINED FRAMEWORKAn authorisation
An authorisation
has a scope.
And an end.
Autonomous defence may need to suspend a session or isolate a workload without waiting for a lengthy approval chain. A corridor defines in advance the conditions under which it may do so.
Its continuation depends on context. Its duration is limited. Exit, suspension and, where relevant, rollback must be planned.
EXAMPLE CORRIDORILLUSTRATIVE
Temporary isolation
of a workload.
ENTRY
Qualified signals and an identified scope.
LIMITS
Maximum impact and duration defined by the organisation.
CONTINUATION
Conditions reassessed; contradictions accounted for.
EXIT
Expiry, lifting the measure or human approval.
EVIDENCE
Decision, execution or non-execution retained.
05 / USE CASESFROM CYBERDEFENCE TO BUSINESS ACTIONS
Different operators.
The same need for control.
The scenarios below illustrate control points to design. They require explicit rules and points of effect effectively covered by the integration.
Respond to a threat
without extending the incident.
A defence agent proposes revoking a token and isolating a service. The response may be appropriate, but its impact on production must inform the decision.
- What must be governed
- The context, affected scope, reversibility and applicable response corridor.
- What must be established
- Who proposed the measure, what authorised it, what was executed and the observed effect.
ENVIRONMENTS ENVISAGED
ERP · Financial systems · Cloud services · IT operations · Third-party APIs · Human approval
06 / EXAMINE A TRANSACTIONDECISION · EFFECT · EVIDENCE
Three questions.
Three distinct answers.
What was decided.
What happened.
What can be established.
The transaction explorer connects the agent, action, target, decision mode and evidence. It identifies denials, incomplete or unknown states and degraded evidence, then opens the detailed path of an action.
EXAMPLE / ACCOUNT DELETIONFICTIONAL DATA
Identity verified.
Insufficient mandate.
The support agent is identified. It requests permanent account deletion, but its mandate does not cover that effect. In this example, the intercepted action is not forwarded to the target system.
DECISIONDenied
EFFECTBlocked
EVIDENCEConfirmed
WHAT THE RECORD MUST RETAIN
The request, resolved identity, mandate boundary, applied rule, denial decision and confirmation that nothing was forwarded.
THE HUMAN ARBITRATION QUEUE
Insufficient authority, incomplete context, unknown target state, degraded evidence or required requalification: every exception must be examinable with its reasons and supporting evidence.
07 / EVIDENCE AND ACCOUNTABILITYAVOID SELF-CONFIRMATION
An observed effect
does not prove
the decision
was right.
“I isolated the service. Traffic stopped. Therefore I was right.”
A system can itself cause the result it then uses to justify its decision. Traffic stopping after isolation does not, on its own, demonstrate that the initial threat qualification was correct.
HECTOR’s doctrine requires independent evidence to be distinguished from effects caused by the system. Contradictions must remain visible; new knowledge or rules must be incorporated through a governed framework.
THE PRINCIPLE
A past decision does not become
authority for the next one.
RECONSTRUCT THE CHAIN
Initiator → Context → Applicable rule → Decision → Execution → Effect → Evidence → Contradictions
08 / IN YOUR ARCHITECTUREA COMPLEMENTARY LAYER
Connect decisions
to points of effect.
For organisations,
publishers and integrators.
Context and initiative.
Alerts, signals, recommendations, agent requests and information from your existing tools.
Execution governance.
Qualify identity, authority and action; arbitrate, establish executability, control the relay and retain evidence.
Systems that act.
Orchestration tools, gateways, access management, cloud services, databases and tool calls.
TARGET ARCHITECTURE COMMITMENTSA chain of control.
A chain of control.
Distinct responsibilities.
The product target connects action intake, trust and context qualification, arbitration, executability, relay to systems, evidence and governance of the mechanism.
Identification is not a mandate.
A source’s identity, trust and continuity of delegation are qualified separately. Verified identity does not, on its own, confer authority to produce an effect.
A favourable decision still needs to be made executable.
The passage to effect depends on verified conditions and a contextualised, bounded, signed permit revalidated before use. A refusal by the target system must be retained.
An acknowledgement does not prove an effect.
The relay to the target is followed by observation and reconciliation between the expected and observed effect. A discrepancy remains visible and may require governed correction or compensation.
The chain must retain its evidence.
An append-only ledger, causal links and integrity checks support reconstruction. Degraded evidence and gaps remain visible; supervision metrics serve a separate purpose.
THE FRAMEWORK EVOLVES THROUGH GOVERNANCE
Policies, profiles and corridors follow a cycle of proposal, review, signed and versioned publication, then controlled activation. Suspension, rollback and deactivation must also remain traceable.
ENVISAGED CONNECTION MODESConnect to the path
Connect to the path
through which action passes.
The connection mode and control level must be qualified together. An established link does not prove that an action can be intercepted.
01 / DIRECT CONNECTION
Enrol an agent with an API key.
Create a link between HECTOR and the agent’s API, define its profile, then verify connectivity. Technical identity, permissions and the action path still need qualification.
THE WORKFLOW SHOWN
- Configure the agent and connection point.
- Verify connectivity and profile.
- Review the enrolment summary.
A key identifies an access method; it does not, on its own, authorise every effect.
Workflows adapted from functional mockups. No connection is made and no secret is collected on this website.
For publishers
Consider an execution-governance component that integrates with their detection, orchestration or agentic-control capabilities.
For integrators
Build architectures where delegated autonomy, operational limits and evidence are defined together.
The scope of integrations and controlled actions is defined by the target architecture. The environments listed describe a design direction and use cases.
09 / PROJECT SCREENSFUNCTIONAL MOCKUPS
FROM COCKPIT TO ACTION DETAILS
01 / 09Control at the scale of your uses.
Supervise mediated sources, exceptions and transactions requiring arbitration.
Functional mockups — project in development.THE PRINCIPLE IN MOTION
Continuity of control.
From choosing to act to the evidence needed to examine what was done.
Which actions
do you choose
to delegate?
Let us start with your agents, your target systems
and the effects you want to govern.