The team that rolls this out does not experience it as a benchmark. They experience it as a queue of held actions, a rota of people who have to look at them, and one awkward conversation with the engineer whose Tuesday afternoon vanished into a hold that turned out to be fine.
The gap the product aims at is specific. Permissions answer whether an agent may touch a repository; they do not answer whether this particular write fits the task the agent was handed, and reading logs afterwards names the incident only once it has happened, according to Capsule [3]. So the classifier goes into the path, scoring the intended action just before execution while the customer's policy allows, flags or blocks it [2]. The training material included real agent traces plus adversarial examples written to mark where authorized behavior ends, with humans reviewing the set [11].
Two points of error against a 9,429-trajectory benchmark works out to roughly 189 trajectories [1], the sort of arithmetic that makes a 98% headline feel solid. The benchmark's authors are measuring something else. They report that one rule-based guardrail caught most rogue trajectories while more than three-quarters of its alerts fired on benign code written before anything went wrong, and they argue that accuracy and recall miss the point [6]. The number an operator needs is how often the control halts good work, and the figures in Capsule's release, as relayed by SiliconAngle, are accuracy figures.
The speed claim survives contact better. Ten held steps in one chain add at least 0.71 seconds [2], which is noise beside a test run and only starts to matter if you decide to judge every file read.
The comparison table is where the deck gets ahead of the evidence. The 10.9-point margin [3] is over a model Capsule declined to name, with no score breakdown offered [9], while the frontier systems it says it beat, from OpenAI, Anthropic and Google, are named [10]. What is checkable sits elsewhere. Capsule says billions of tokens across millions of agent interactions already pass through the technology, with financial institutions and technology companies among its customers [13]. Phillip Miller, global chief information security officer at H&R Block, said controls of this kind let security teams widen their use of agentic AI while keeping the security, governance and accountability their clients expect [14]. And on launch day the company disclosed prompt injection flaws in Microsoft Copilot Studio and Salesforce Agentforce, both since patched [16], which is a better credential than an internal scoreboard.
Two axes are worth drawing before anyone signs. One is whether the action can be undone. The other is how often the agent takes it. Rare and irreversible, a wire transfer or a force push to main, is where a synchronous hold earns both its milliseconds and its false positives, and where a human should be paged. Frequent and reversible, reading a file or running the test suite, is where blocking buys the least protection for the most resentment, so log and sample there instead. The two mixed cells are the real argument, and the honest way to settle them is a shadow period where the model flags and never blocks, scored on how many of its flags a human would also have stopped.
