Announcement: Now accepting design beta partners · Read more
Maya logo

Agentic Networking

Product

Your network sees lanes. Maya sees the vehicles.

Maya rebuilds the network primitives you already trust — identity, authorization, balancing, priority — around the agent instead of the host. All of it payload-blind: Maya never terminates TLS and never decrypts your traffic.

The Agentic Networking Stack. A fair swap: every network primitive, agent-native. IP address becomes AID, Agent Identity: who the agent is, from the wire. DNS becomes MCP: what it's allowed to reach. Load balancer becomes aiLB: balances by agent, not by socket. QoS becomes aiQoS: priority and budget per agent. Fabric becomes Substrate: one identity-aware fabric, everywhere. Maya: make every agent visible, governable, accountable.

Maya Substrate

A programmable, agent-identity-aware fabric

Identity-aware fabric

Assigns and carries agent identity in the datapath — east–west (A2A) and north–south (egress), across regions, providers, and geos.

Telemetry, not lock-in

Emits open telemetry (OTLP) into the tools you already run. Maya adds a layer; it doesn't replace your stack.

Policy you control

Deviations are typed, auditable events you route and act on. Enforcement is operator-controlled, per agent — and deliberately observe-first.

Declared once, governed continuously

One view of every agent across clusters, clouds, and regions — Warps in every region, one Loom for the fleet.

The Standalone Agentic Firewall

Solving problems you can't see yet

  1. Declare. one env var per agent

  2. Observe. from the wire

  3. Deviate. typed event fires

  4. Decide. console / callback

  5. Enforce. in-line, reversible

Hardest-hitting use case

Per-agent authorized providers — from the wire

Declare which model and inference providers each agent may reach — the same list as your ICT third-party register. When a declared agent reaches an unlisted provider, Maya fires a typed deviation. Built for financial services under DORA and SOX.

A2A Conversations

Delegation edges from live flow data. Every edge is attributed to the agent that made it.

Agents
Conversations
Deviations 1
Declarations
Destinations
Export
System
WARP CONNECTED · :443
14:22:06 UTC
Declared agents
12
3 zones
A2A conversations
14
cross-zone edges
New flows/sec
2.4
flows/sec
Attribution rate
99.2%
flows named to an agent
Open deviations
1
contradicts declared
Throughput
18 Kpps
10s avg
A2A conversations · delegation edges from live flow data 14 conversations · 1,284 flows
VIEW
☰ list◎ graph
92 flows 6 flows 71 flows 14 flows 3 flows 4 flows claims-triage eu-west-1a kyc-screening us-east-1a invoice-processor eu-west-1a benefits-enroller eu-west-1a endpoint-monitor us-east-1a access-provisioner us-east-1a expense-auditor us-east-1a it-helpdesk us-west-2b hr-onboarding us-west-2b market-data-feed us-west-2b vendor-sync us-east-1a ledger-core eu-west-1a report-exporter eu-west-1a REACH · undeclared UNDECLARED ENDPOINT 203.0.113.42 · :443
delegation edge contradicts declaration edge width · flow volume
us-east-1a eu-west-1a us-west-2b
Every edge is attributed to the agent that made it. No SDK, no sidecar, no code change. Agents declare where they are allowed to reach; Maya reports when one goes somewhere else.

Inside the Console

Deviations: an agent did something it never declared. Review it, contain it, reverse it.

Deviations
An agent did something it never declared
Warp connected
admin▾
12/12
Active agents
38 MB/hr avg
AI egress
3
Open deviations
1
Provider mismatches
1
Over budget

Deviations

an agent did something it never declared
☰ List▤ AI Egress
Type all Providers1 Reach1 Egress budget1
Source all Contradicts declared3
By type · Open
Providers
1
Reach
1
Egress budget
1
Agent What happened Declared → Seen Severity Last seen
ledger-sync
Providers
 Reached an inference provider that is not on its authorized list provider-a, provider-b → provider-c High 6m ago
reviewdismiss
claims-triage
Reach
 Declared internal only, observed reaching a public destination internal → public: 203.0.113.42 Medium 22m ago
reviewdismiss
invoice-reconciler
Egress budget
 Crossed 100% of its declared hourly egress budget 4 MB/hr → 4.3 MB/hr Medium 1h ago
reviewdismiss
Every row acts on new traffic, not the flow that triggered it. Maya reports and contains, it does not retroactively unsend.

Proven now

  • Wire-level agent identity, assigned from a single env var — no code, no SDK, no sidecar
  • Live deviation firing + reversible enforcement on the box
  • Cross-host agent-to-agent flow, wire-proven
  • Open telemetry (OTLP) streaming into existing tools
  • Payload-blind datapath — no TLS termination, no decryption
  • In-VPC deployment on your data and your keys

Next

  • Provider & peer deviations, live on the wire
  • Density & performance ramp toward agent scale
  • Kubernetes DaemonSet packaging
  • Bring-your-own-judge (BYOJ) policy, GA
  • Single-pane console across regions & providers
  • Setpoint: behavioral posture reasoning over fleet telemetry, human-in-the-loop by default

Items shown as next are under development, subject to change, and not commitments of timing or functionality.

Start an observe-only pilot