Over the past few months, we’ve been experimenting with something that kept bothering us about AI agents in production.
Most agent systems today are “fail-open”: • The model proposes an action • The tool executes • Logs are written • Monitoring happens after the fact
This works fine for demos and low-risk workflows.
It feels different when agents: • trigger payments • deploy code • modify production data • access local files • interact with real infrastructure
We started asking a simple question:
What if execution itself was policy-bound?
⸻
What we built
We built a runtime authorization layer that sits between:
LLM → Proposed Action → Policy Engine → Allow / Deny / Compute / Escalate → Execution → Trace + Replay
Instead of parsing messages or relying on post-hoc logs, we: • evaluate the proposed tool invocation • bind it to a policy (OPA-based) • gate execution before it runs • emit reproducible artifacts
Each decision produces: • policy digest • input/output hash • trace ID • optional ledger entry • replay support
⸻
What this is NOT • Not another agent framework • Not a monitoring dashboard • Not prompt-level guardrails • Not pattern extraction
It operates at the action surface.
If the agent attempts to call a tool, the call is evaluated before runtime.
⸻
Example (simplified)
If the agent tries:
fs.write_file(”/prod/config.yaml”)
Policy may: • DENY • ESCALATE (human required) • COMPUTE (force safe path) • ALLOW with constraints
The key idea:
Authorization becomes structural, not contractual.
⸻
Why we built it
There’s a growing gap between:
Model capability and System accountability
As agents move from answering to acting, the stack shifts.
We’re curious whether others are running into the same problem.
⸻
Looking for feedback
We’re currently: • running this locally via a desktop client • integrating with MCP tool surfaces • experimenting with observe-only and enforce modes
Would love thoughts from folks: • deploying agents in production • thinking about policy / governance • building infra around AI execution
Especially interested in criticism.
Happy to share architecture details.