Xybern/Industries/Healthcare
An agent summarising a discharge note does not need the whole patient population. Xybern scopes each agent to the exact record, action, and window its task requires, and denies everything else before it executes.
of record access decided before it happens
standing agent access to patient data
unsafe actions caught in the published benchmark
legitimate actions falsely blocked
The first two are structural properties of the layer: no action reaches your systems without a verdict. The benchmark figures come from an open, reproducible test of 137 attack and legitimate scenarios drawn from OWASP, MITRE ATLAS, and CWE. Read the methodology →
We begin with the workflow that touches the most sensitive data for the least clinical benefit if it goes wrong, and prove the boundary holds before it enforces.
An agent is granted access to a named patient for the duration of a task. The grant expires on its own. Queries outside that scope are denied rather than logged for later review.
Routing decisions run inside a declared protocol. Anything the agent proposes outside that protocol is escalated to a clinician instead of executed.
Actions that change a care plan or commit a resource are held for human approval by default, with the agent waiting rather than proceeding on assumption.
Xybern Redact strips identifiers from prompts before they reach any model and restores them on the way back, so a third-party model never receives PHI.
Describe what an agent is for and Access Profiles propose the narrowest set of actions that lets it do that job. Everything outside the box is denied or escalated.
Every retrieval, denial, and escalation is sealed with a signed receipt, so access reviews start from a record instead of an interview.
Deploy inside your own environment with data residency controls and workspace isolation, including fully air-gapped installations.
Put your highest-consequence workflow behind the layer in shadow mode and see exactly what would have been stopped, before anything is enforced.
