Live watch on supported agent traffic
- Optics
- Yes — report only
- Phantom Engine
- Yes
- Enterprise
- Yes
Architecture · Observe · Enforce · Control
Architecture
Observe, Enforce, and Control operate together as Phantom Engine. They are not separate products.
Where each layer sits
The Vantio control architecture
Observe, Enforce, and Control operate together as Phantom Engine. They are not separate products.
Topology
Govern
Vantio Enterprise
Ownership, delegated authority, approvals, dual control, exceptions, and durable evidence.
Observe · Enforce · Control
Phantom Engine
One product. Three enforcement planes on enrolled Linux infrastructure.
Host
Enrolled Linux host
The machines you enroll. Exact coverage is documented for that deployment.
Optics
Optics is Vantio’s free observability product for teams beginning to understand autonomous-agent activity. It shows where supported agents connect and provides process and trace context without storing prompts or completions.
Continuous Assurance
Verifies control state across the chain. Reconciles evidence and keeps known gaps visible. It is not a fifth product.
For engineers
For engineers
- eBPF
- Extended Berkeley Packet Filter: a Linux kernel mechanism Phantom Engine uses to observe and constrain process, filesystem, and network activity on enrolled hosts.
- LSM
- Linux Security Module: kernel hooks that can allow or refuse operations according to policy on the enrolled host.
- Enforcement daemon
- The Phantom Engine process that runs on each enrolled Linux host and applies Control.
- Process inheritance
- Child processes keep the parent’s enforcement identity so a spawn is not a free pass around the rules.
- Trace correlation
- Matching application-path records with host events so a bypass can be named.
- Bypass indication
- The signal that host activity has no matching application-path record.
Continuous Assurance is the platform trust loop that verifies the chain. It is not another plan.
Data and privacy
What Vantio records — and what it refuses to keep.
Recorded
- DestinationWhere the agent tried to connect
- Process contextWhat ran, under what identity
- Volume & timingHow much moved, and when
- DecisionOBSERVED, ALLOWED, BLOCKED, REDACTED, or a named host gap
- TraceEnough to match events across layers
Never retained
- PromptsUser and system instructions stay out
- CompletionsModel output is not stored in Vantio’s hosted records
- Tool payloads as chatVantio’s hosted records do not build a conversation warehouse
- Customer secrets by designRedaction is an Enforce-plane action, not a retention strategy
Coverage and limitations
What each product provides
Product prices live on Pricing. Path status lives on Compatibility.
| Capability | Optics | Phantom Engine | Enterprise |
|---|---|---|---|
| Live watch on supported agent traffic | Yes — report only | Yes | Yes |
| Action labels | OBSERVED | ALLOWED / BLOCKED / REDACTED + named coverage gap | Same + reviewable evidence |
| Policy as code · preview → enforce | — | Yes | Yes |
| Enforce on the agent path | — | Destination, sensitive-data, and spending policies | Yes |
| Runtime protection on machines you own | — | Yes | Governance on Phantom Engine |
| Bypass indication on enrolled hosts | — | Correlates app-path decisions with host events | Same + durable correlated evidence |
| Durable evidence · audit records · dual-control | — | — | Yes |
Action labels
- Optics
- OBSERVED
- Phantom Engine
- ALLOWED / BLOCKED / REDACTED + named coverage gap
- Enterprise
- Same + reviewable evidence
Policy as code · preview → enforce
- Optics
- —
- Phantom Engine
- Yes
- Enterprise
- Yes
Enforce on the agent path
- Optics
- —
- Phantom Engine
- Destination, sensitive-data, and spending policies
- Enterprise
- Yes
Runtime protection on machines you own
- Optics
- —
- Phantom Engine
- Yes
- Enterprise
- Governance on Phantom Engine
Bypass indication on enrolled hosts
- Optics
- —
- Phantom Engine
- Correlates app-path decisions with host events
- Enterprise
- Same + durable correlated evidence
Durable evidence · audit records · dual-control
- Optics
- —
- Phantom Engine
- —
- Enterprise
- Yes