Roadmap

Gensee Crate is expanding protection for autonomous AI across personal tasks, knowledge work, software development, and business automation. It has two deployment paths built on the same policy and evidence model. Personal reviews local agent work, creates recovery points, audits configuration, and can independently verify supported macOS process and file activity. Team runs agents on prepared Linux hosts with disposable workspace forks, scoped capabilities, short-lived leases, host-side evidence, and human-controlled promotion.

Current integrations include Claude Code, Codex, Antigravity, Cursor, and VS Code / GitHub Copilot, with managed-launch coverage for Omnigent. The macOS Claude Cowork pilot adds host activity and VM-boundary visibility; guest commands and cloud execution remain outside endpoint coverage. Linux host support includes /proc process attribution, capability planning, fanotify sensitive-path enforcement, seccomp launcher profiles, and cgroup-scoped nftables egress controls. This roadmap is directional and may change as agent interfaces and operating-system controls evolve.

Operation-bound protection

Available now in the explicit boundary runtime:

• Approved operation contracts and admission, with signed catalogs and bounded intent inference.
• Scoped network authority, execution-subject ownership, typed capability-provider leases, and authenticated downstream operation context.
• Staged product inspection, isolated semantic verifier receipts, and transactional promotion with digest revalidation, terminal authority, compare-and-swap selection, and crash recovery.

This is implemented for the documented host controls and effect classes. It is not automatic transactional containment for every Cowork or hook-mediated action. Expansion to additional effect classes and integrations remains planned.

Long-horizon understanding and quieter reviews

Available now: cross-session artifact provenance, digest-bound execution checks, verification freshness, background-task request attribution, scoped approvals, explicit read exceptions, and separate false-positive feedback. See long-horizon understanding and the v0.3.3 guide.

Pattern suggestions and optional model-assisted triage are planned. Repeated approvals do not silently expand a permission, and feedback does not grant access.

Linux System Enforcement

Gensee Crate's Linux support will continue covering AI agents running directly on workstations and self-hosted servers, as well as agents in containers.

Available now:

• Process-tree attribution for Claude Code, Codex, Omnigent, and other local agents through /proc.
• Host capability reporting through gensee status.
• Sidecar attachment for existing Linux agent process trees through gensee watch --pid <pid>.
• Fanotify permission enforcement for gensee run and gensee watch --pid, with built-in credential-path rules and configurable linux.fanotify.paths for exact paths and prefix roots such as ~/.ssh/**.
• Seccomp launcher profiles configured through policy and applied by gensee run --sandbox linux -- <agent> to hard-deny dangerous syscall families such as ptrace, bpf, kernel module loading, mount changes, and namespace switching.
• Cgroup/nftables egress controls through the preferred gensee run --sandbox linux -- <agent> launch workflow, scoped to a cgroup v2 agent process tree and policy-managed IP/CIDR allowlists, denylists, or deny-all mode. Low-level planning/apply commands live under gensee debug.

Planned work includes:

• Linux-native eBPF file, process, and network monitoring.
• Continuous fanotify ownership in a daemon, so sensitive-path permission events can survive policy reloads and multi-agent session lifecycle beyond the current run and watch --pid listeners.
• Recursive suffix-pattern coverage for rules such as **/.env and **/.env.*.
• Landlock and AppArmor profile generation where those systems are available.
• Richer audit trails that connect agent intent, child PID attribution, per-attempt network timestamps, file access, and policy decisions.

Endpoint Security-Based Defense

On macOS, Gensee Crate now ships a first-party, signed Endpoint Security system extension and native security console. The extension replaces eslogger in the normal product path and connects kernel-owned evidence to the same Rust policy, attribution, and local-store backend used by the OSS CLI.

Available now:

• Exact process identity and process-tree evidence for exec, fork, and exit.
• File open, directory read, mmap, create, write, close, rename, unlink, and truncate evidence attributed to the responsible process.
• Local authorization for configured protected paths and blocked executables in explicitly managed agent process trees.
• off, observe, protect, and strict modes with an observe-first default and a bounded, local authorization path that never waits for the UI.
• A SwiftUI console for extension lifecycle, health, policy mode, Full Disk Access guidance, and installed-harness protection toggles.

Planned work includes:

• Broader authorization coverage and policy controls for supported Endpoint Security operations.
• Stronger correlation between agent prompts/tool calls and OS-level events.
• Detection and explanation of bypass attempts outside the normal hook path, including alternative shells, background jobs, and indirect interpreters.
• Richer descendant and cross-session attribution for concurrent harnesses.
• System-level network visibility through a separate Network Extension, packet filter, or equivalent sensor; Endpoint Security is not a packet monitor.

Sandbox Support

Gensee Crate will continue improving sandboxed and staged execution for risky agent actions.

Planned work includes:

• Stronger gensee run confinement for local agents.
• Reviewable staged workspace writes before changes reach the real project.
• Policy-aware sandbox modes for file access, network access, and command execution.
• Expand the existing operation-bound runtime to additional effect classes and workflows, with explicit containment, verification, and promotion semantics.
• Better support for managed Linux runtimes and cloud-based agent workspaces.

ML-Based Policy and Rules

Current policy decisions are deterministic and rule-based. Future versions may use ML-assisted policy to improve detection, reduce noise, and adapt to new agent behaviors.

Planned work includes:

• Learning from controlled traces of policy decisions, blocked actions, and bypass attempts.
• Detecting retry patterns, tool substitution, path substitution, encoding tricks, delayed execution, and exfiltration-like behavior.
• Policy recommendations based on observed project and agent behavior.
• Optional ML-assisted risk scoring alongside deterministic rules.
• Evaluation datasets for comparing rule-only and ML-assisted defenses.

Integrations

Gensee Crate aims to work with the AI agents, workflow platforms, and security tools people already use. Glean and n8n support below is planned; neither adapter ships today.

Planned integration areas include:

• Glean Agents: bring agent runs and available action/data-access evidence into request-based review. Explore scoped policy checks and approvals for actions mediated through supported integration points. Distinguish Glean's service-provided evidence from independently observed endpoint effects. Integration design will follow the documented Glean Agents and actions interfaces and customer access permissions.
• n8n: connect workflow executions, AI agent tool calls, retries, and sub-workflows to their originating trigger or request. Start with self-hosted workflows and explicit policy/approval steps before external actions, then assess n8n Cloud coverage through supported APIs and workflow integration points. See n8n's AI agent workflow overview.
• Additional AI agents and assistants such as ChatGPT and Gemini. Cursor and GitHub Copilot hook support are available today.
• Broader agent orchestration support beyond Omnigent's current managed-launch coverage.
• Security tooling such as CrowdStrike and other endpoint or detection systems.
• LLM gateways, MCP servers, and policy/control-plane tools.
• Export formats for sharing local audit trails, alerts, and policy decisions with external systems.

For Glean and n8n, the first milestone is a documented coverage map and an observe-first pilot with request attribution. Enforcement will be added only where the integration can reliably intercept an action. Each adapter should keep routine activity quiet, support explicit scoped approvals, and make missing evidence and unsupported execution surfaces visible. SaaS activity will not be presented as fully covered by a laptop sensor.