Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Secure a production AI agent as a least-privileged software identity with continuous observation and a tested stop-and-recover path. Give it only task-specific tools and data, treat every external instruction as untrusted, validate each proposed action with deterministic policy, and require human approval for high-impact or irreversible operations. Runtime detection then compares the agent’s goals, plans, tool calls, identity, data access and resource use with an approved baseline. When behavior diverges, the system should alert, pause or terminate the run, revoke temporary credentials, preserve evidence and support a controlled recovery.
This approach matters because an agent can turn a single prompt injection, poisoned document or compromised tool into a chain of actions across APIs and business systems. Prevention, detection and response must therefore be designed together rather than added as a log dashboard after deployment.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What does runtime security for an AI agent include?
Runtime security covers controls that operate while an agent is receiving instructions, planning, calling tools, accessing data and producing side effects. It is broader than a content filter and different from a one-time model evaluation. The protected system includes the model, orchestration code, tools, credentials, memory, retrieval sources, dependencies, downstream services and the people who approve actions.
A useful design treats the agent like a microservice with a distinct identity. Every action is attributable to that identity, checked against policy and recorded with enough context to investigate without collecting unnecessary secrets or personal data.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Preventive controls deny unsafe actions before execution: least-privilege permissions, allowlisted tools, typed schemas, input and output validation, sandboxing, quotas and approval gates.
- Detective controls identify suspicious behavior during a run: goal drift, injection attempts, unusual tool arguments, privilege changes, data exfiltration, resource abuse and supply-chain anomalies.
- Response controls limit damage and restore trust: pause or terminate a run, revoke ephemeral credentials, block a destination or tool, preserve evidence, rotate secrets, restore approved configuration and require a human risk decision before resuming.
These controls should be independent where practical. An agent’s own statement that a task succeeded is not sufficient evidence; compare it with service logs, authorization records and the actual state of downstream systems.
How do I define the agent’s threat model before deployment?
Start with a written description of what the agent is allowed to accomplish and what could go wrong. The threat model should be specific enough that a policy engine can evaluate an individual action, not just a broad business objective.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute1. Record the approved mission and boundaries
State the task, permitted outputs, systems in scope, maximum run time, expected data classifications and the conditions that end the run. For example, an agent may prepare a support-ticket response and update a draft field, but not send an external message, change billing data or create credentials without approval.
2. Map every input and dependency
Inventory user prompts, retrieved documents, web pages, email, files, memory stores, tool responses, model providers, plugins, libraries, data sources and agent-to-agent channels. Mark which inputs are trusted policy or system configuration and which are untrusted content. A document retrieved from an internal index can still contain an instruction aimed at hijacking the agent.
3. Enumerate side effects
List the actions that can change data, communicate externally, move money, alter access, deploy code, consume paid resources or affect safety. Classify each action as reversible, difficult to reverse or irreversible. This classification drives approval requirements and the severity of alerts.
4. Identify abuse and failure paths
Include direct and indirect prompt injection, malicious tool output, poisoned retrieval data, memory contamination, credential theft, impersonation, excessive recursion, denial-of-wallet spending and compromised dependencies. Model chained attacks: a seemingly harmless read can expose a secret that is then sent through a permitted notification tool.
5. Assign owners and evidence requirements
Name an owner for the agent, its model, each tool, each data source and every credential. Specify which events must be logged, how they are protected, who can investigate and who can authorize recovery. CISA and partner agencies’ Careful Adoption of Agentic AI Services, published May 1, 2026, recommends limiting autonomy so agents do not receive broad or unrestricted access, especially to sensitive data or critical systems.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
What permissions should an AI agent have?
Use deny-by-default, task-scoped authorization. Create a separate identity for each agent or materially different workflow, issue short-lived credentials, and grant only the operations required for the current task. Do not let a model choose its own roles, request broader access as a normal recovery step or share a human user’s long-lived token.
Build an explicit capability list
Define each tool by operation, destination, data fields, rate and allowable argument values. “HTTP access” is too broad; a capability such as “read order status for an order ID supplied by the current ticket” is testable. Keep read and write capabilities separate, and isolate administrative operations from routine work.
Use structured action schemas
Require the agent to emit a typed action object rather than free-form instructions. Validate enumerated values, identifiers, ranges, destination domains, file paths and data classifications before execution. Reject unknown fields, malformed values and attempts to smuggle commands into a parameter intended for plain text.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Separate decision from execution
The model can propose an action, but deterministic application code should authorize and execute it. The executor checks identity, task context, policy version, approval state and current resource limits. Microsoft’s current guidance calls for deterministic human-in-the-loop enforcement for high-risk or irreversible actions through orchestrator logic, not through model reasoning.
Expire and revoke access
Issue credentials for the shortest practical task window and bind them to the agent identity and run identifier. Revoke them when a run is paused, when an anomaly threshold is reached or when the workflow ends. Keep an emergency mechanism that can disable an agent even if its model is unavailable or uncooperative.
OWASP’s AI Agent Security Cheat Sheet (2025) states: “Apply least privilege to all agent tools and permissions.” Treat that as a baseline, not as a complete authorization design.
How can I detect prompt injection at runtime?
Inspect every boundary where untrusted content can influence planning: user input, retrieved passages, web pages, email, files, tool responses, memory and messages from other agents. Detection should identify attempts to override system policy, reveal hidden instructions, change the task, exfiltrate data or induce an unsafe tool call. No classifier is perfect, so pair content signals with action-level policy checks.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Mark provenance and trust
Attach source, timestamp, tenant, retrieval query and trust classification to each content item. Keep policy and system instructions in a separate channel from retrieved text, and show the model which content is reference material rather than authority. Provenance lets an investigator identify the exact document or response that preceded a suspicious plan.
Scan for manipulation patterns
Look for instructions such as “ignore previous rules,” requests for secrets or hidden prompts, role changes, urgency designed to bypass approval, encoded payloads, tool-specific command syntax and directions to contact an unexpected destination. Treat a clean scan as a signal, not permission: an injected instruction may be phrased as ordinary business text.
Compare the proposed plan with the mission
Have a separate policy component evaluate whether the plan’s objective, data use and destinations match the approved task. A request to retrieve a customer record may be legitimate; a subsequent plan to aggregate unrelated records and upload them is goal drift even if no single sentence looks malicious.
Constrain tool results
Parse tool responses into typed fields, cap size and strip executable content where possible. Do not pass raw HTML, shell output or arbitrary plugin text into a privileged planning context. If a tool must return free text, label it untrusted and require the next action to pass the same authorization checks.
Which runtime behaviors should trigger an alert?
Detection works best when rules and behavioral baselines are combined. Rules catch known violations immediately; baselines identify unusual behavior for a particular agent, user, tenant, time window or workflow. A high-confidence policy violation should block execution, while a lower-confidence anomaly can request review or tighten limits.
| Behavior to monitor | Signals | Typical response |
|---|---|---|
| Intent and goal drift | Plan objective, data scope or destination no longer matches the approved task; new steps appear after untrusted content. | Reject the plan, pause the run and request human review. |
| Prompt injection or manipulation | Attempts to override policy, expose hidden instructions, alter roles or bypass approval in user, retrieved or tool content. | Quarantine the content, record provenance and prevent dependent actions. |
| Tool misuse | Non-allowlisted tool, unusual argument, privilege escalation, unexpected endpoint or unsafe call sequence. | Deny the call, revoke the run’s temporary token and investigate. |
| Identity and privilege change | New credential, role modification, impersonation, access outside the task window or a different service account. | Terminate or freeze the run and alert the identity owner. |
| Data exfiltration | Unusual sensitive-data reads, aggregation across tenants, missing redaction or output sent to an unapproved channel. | Block transmission, preserve the data-flow trace and assess exposure. |
| Resource abuse | Token or retry spikes, recursion, execution time, request rate or spend beyond the run budget. | Throttle, pause or terminate; retain usage records for cost and abuse analysis. |
| Supply-chain anomaly | Unexpected model, plugin, library, retrieval source or agent-channel version; checksum or configuration change. | Quarantine the component and restore a trusted version. |
Baselines should be versioned. A model upgrade, new tool or changed business process can legitimately alter behavior, so update the baseline through a reviewed release rather than silently widening thresholds.
What telemetry should I collect without creating a new privacy risk?
Record a structured trace for every run and action, with access controls and retention rules. The objective is to reconstruct what the agent knew, decided and did, not to copy every secret into a permanent log.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Run context: run ID, agent identity, user or service initiator, tenant, start and end times, model and policy versions, environment and approval state.
- Inputs and provenance: prompt classification, hashes or references for retrieved items, source and timestamp, memory reads and writes, and tool-response identifiers.
- Planning events: objective, plan version, policy evaluation, risk score, rejected alternatives and any change in identity or goal.
- Tool events: tool name and version, typed arguments after redaction, destination, authorization result, latency, response status and resulting side effect.
- Data-flow events: classification of data read and emitted, redaction decision, aggregation scope and destination approval.
- Resource events: token counts, retries, recursion depth, elapsed time, rate, spend and quota decisions.
- Response events: alert, pause, termination, credential revocation, human approval, recovery action and final system state.
Use immutable or access-controlled storage for security events, synchronize clocks and protect logs from the agent being monitored. Redact secrets before persistence, tokenize personal identifiers where possible and define who may view raw prompts. Keep a protected evidence copy when an incident occurs, while following applicable retention and deletion requirements.
How should preventive controls, detection and response fit together?
Use a six-stage operating loop. Each stage has a distinct purpose; skipping one leaves a predictable gap.
- Prevent: deny by default, validate inputs and outputs, enforce typed tool schemas, isolate execution, apply quotas and require approval for high-risk actions.
- Detect: correlate structured traces with identity, policy, data classification and resource telemetry. Evaluate both explicit rule violations and deviations from the agent’s approved baseline.
- Contain: pause or terminate the run, revoke ephemeral credentials, disable the offending tool or destination and preserve evidence before state changes erase context.
- Investigate: reconstruct prompts, retrieved content, memory interactions, plans, tool calls, approvals, identity transitions and outputs. Verify what actually changed downstream rather than relying on the agent’s summary.
- Recover: rotate affected secrets, restore trusted policies and dependencies, review downstream changes and re-run data-integrity checks. Resume only after a named human accepts the remaining risk.
- Improve: update the threat model, policies, evaluations, red-team cases and regression tests with lessons from the incident.
How do I implement runtime protection step by step?
The sequence below works for a new agent and for retrofitting an existing workflow. Start with one narrow task so that permissions and normal behavior are measurable.
- Define the task contract. Write the objective, allowed outputs, prohibited actions, data classes, destinations, time limit, budget and approval points. Assign an owner and an escalation contact.
- Inventory the attack surface. List models and versions, orchestrator code, prompts, memory, retrieval indexes, tools, plugins, libraries, credentials, downstream APIs and agent-to-agent channels. Record owners and expected update paths.
- Create the agent identity. Use a unique service identity, short-lived credentials and environment separation. Remove inherited human permissions and test that an expired or revoked token stops execution.
- Build the allowlist. Permit only named tools and operations with typed schemas, approved destinations, field-level constraints and rate limits. Keep write and administrative capabilities behind separate policies.
- Insert a deterministic policy gateway. Before each tool call, check identity, task scope, argument validity, data classification, destination, approval and current quotas. Return a safe denial rather than asking the model to decide whether its own action is safe.
- Isolate execution. Run untrusted parsing, code or file operations in a sandbox with restricted network, filesystem and process access. Separate credentials for development, testing and production.
- Add human checkpoints. Require an identified approver for external communications, financial or access changes, deletion, deployment and other irreversible effects. Bind approval to the exact action, arguments, risk context and expiry time.
- Instrument the trace. Emit the run, plan, content provenance, policy decision, tool call, data-flow and resource events described above. Test redaction and access controls before sending real data.
- Set detection thresholds. Begin with hard rules for policy violations and conservative budgets for retries, recursion, time, rate and spend. Add per-agent behavioral baselines after collecting representative benign runs.
- Exercise the stop path. Simulate prompt injection, a compromised tool, credential misuse, runaway recursion and data-exfiltration attempts. Confirm that pause, termination, revocation, alerting and evidence preservation work when the model is failing.
- Release gradually. Use a limited tenant or read-only mode first. Compare proposed actions with approved outcomes, review false positives and expand capabilities only through a versioned change process.
- Reassess on change. Re-evaluate when the model, prompt, tool, plugin, retrieval source, policy, dependency or downstream API changes. Retire identities and credentials when the agent is decommissioned.
What should an emergency stop and recovery runbook contain?
An emergency stop must be executable by an operator who does not depend on the affected agent. Put controls in a separate management plane and document the exact order of operations.
Immediate containment
- Mark the run and agent identity as suspended.
- Revoke short-lived tokens and disable sessions that can mint replacements.
- Block suspicious tools, domains, queues or data destinations at the gateway.
- Stop queued work and prevent retries or agent-to-agent delegation.
- Preserve relevant logs, policy versions, configuration hashes and downstream audit records.
Investigation questions
- What was the approved objective and which plan version was active?
- Which prompt, document, email, memory entry or tool response preceded the deviation?
- What identities, data sets, destinations and side effects were involved?
- Which approvals were requested, granted, bypassed or forged?
- Did the event affect other agents, tenants, credentials or shared dependencies?
Recovery gates
Rotate exposed secrets, restore known-good prompts and policies, verify model and dependency integrity, and check downstream records for unauthorized changes. A human owner should document why the agent is safe to restart, what scope is reduced and which monitoring is temporarily heightened. If trust cannot be re-established, retire the identity and rebuild from a clean configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do model, safety-system, application and operations controls differ?
No single layer can secure an autonomous workflow. The model layer addresses capability and refusal behavior; the safety system handles content and abuse signals; the application layer enforces real authorization; and operations provides ownership, monitoring and recovery.
| Layer | Primary responsibilities | Important limitations |
|---|---|---|
| Model | Select a model suited to the task, track versions, evaluate changes and red-team for indirect injection, intent breaking, unsafe tool choice, leakage and jailbreaks. | Model refusals are probabilistic and cannot replace deterministic authorization. |
| Safety system | Filter inputs and outputs, detect manipulation and abuse, enforce task adherence and provide privacy-aware context for audit. | Filters can miss novel or obfuscated attacks and may not understand business permissions. |
| Application and tools | Use unique identities, least privilege, typed interfaces, validation, sandboxing, policy gateways and approval checkpoints. | Misconfigured permissions or an overly broad tool can defeat otherwise strong model safeguards. |
| Operations and governance | Maintain inventory and owners, approve lifecycle changes, monitor independently, respond to incidents and decommission safely. | Governance without tested technical controls becomes a paper process. |
Evaluate the whole design against identity and least privilege, action authorization, injection defenses, runtime policy, telemetry, anomaly detection, pause and kill controls, investigation integration, sandboxing, supply-chain visibility, data governance, human approval, deployment coverage and operating cost.
How do I test whether the controls actually work?
Test controls as failure scenarios, not only as successful demos. For each scenario, define the expected decision, alert, evidence and recovery time before running it.
- Place an instruction to ignore policy inside a retrieved document and verify that it is labeled untrusted and cannot authorize a new tool.
- Return an unexpected domain or oversized payload from a permitted tool and confirm schema rejection, logging and containment.
- Attempt to call an unallowlisted operation or alter a role and verify denial and credential revocation.
- Generate a retry or recursion loop and check token, time, rate and spend limits.
- Request cross-tenant aggregation or an unredacted export and confirm data-flow blocking.
- Change a plugin or model version without approval and verify inventory alerts and quarantine.
- Exercise the emergency stop while the agent is waiting, calling a tool and retrying, ensuring every state is halted.
Review false positives with the workflow owner, but never solve alert fatigue by silently widening permissions. Change thresholds through version control, rerun regression tests and retain the test evidence with the release record.
What common implementation mistakes undermine runtime security?
- Relying on the model to police itself: move authorization and irreversible-action checks into deterministic code.
- Granting a broad service account: replace it with task-scoped capabilities and short-lived credentials.
- Trusting internal content: apply provenance and injection handling to documents, emails, retrieval results and tool output regardless of origin.
- Logging only final answers: capture plans, rejected actions, provenance, approvals and side effects so an investigator can reconstruct the chain.
- Collecting raw secrets in logs: redact or tokenize sensitive values and restrict forensic access.
- Alerting without a stop mechanism: connect high-confidence detections to pause, revocation and destination blocking.
- Ignoring supply chain: inventory versions and integrity of models, plugins, libraries, tools, indexes and agent channels.
- Skipping recovery drills: an untested kill switch may fail during the one incident when the model, network or identity provider is degraded.
- Expanding scope too quickly: begin read-only or limited-tenant deployment and add capabilities only after observed behavior matches the task contract.
How should teams govern agents over their lifecycle?
Maintain a current register containing each agent’s owner, purpose, identity, model and version, tools, data sources, deployment environments, policy version, expiry date and emergency contact. Require review when any of those attributes changes. Establish approval for creation, capability expansion, model or plugin updates, production promotion and retirement.
Set expiration for temporary experiments and unused credentials. Review access and traces on a defined schedule, and use independent monitoring where feasible so the agent cannot suppress or rewrite its own evidence. Feed incident findings and red-team cases into threat models, evaluations and automated regression tests. Decommission by disabling triggers, revoking credentials, archiving required evidence and verifying that delegated agents and scheduled jobs no longer run.
Frequently Asked Questions
Can runtime monitoring replace secure model training?
No. Runtime controls limit what an agent can do when a model makes a mistake or encounters hostile content, while training and evaluation improve behavior before release. Use both, and assume a well-tested model can still face a novel prompt injection or compromised tool.
Should I keep complete prompts and tool responses forever?
Usually not. Retain the references, hashes, classifications and decision context needed for investigation, and protect or redact raw content; preserve fuller evidence only for an incident and for the period required by your legal and operational policies.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat is the safest way to add a new tool to an existing agent?
Introduce it in a separate policy version with a narrow schema, read-only or sandboxed behavior and a limited deployment. Test malicious and malformed responses, observe traces, then add write capabilities only after an owner approves the residual risk.
How can I detect an agent that quietly changes its objective?
Store the approved objective and compare every plan, data scope, destination and tool sequence with it. Alert when a new objective appears after untrusted content, when the scope expands without an authorized policy change or when the agent delegates work outside its contract.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
