Selected for GitHub's Secure Open Source Fund. See how it's shaping the future of AI agent security.

Learn more

Policies

What every agent can touch, decided before it touches it.

Access rules that live in a review doc are not access rules. Policies and governance names each agent, states what it may reach, and enforces that at the gateway on every call, leaving an allow-or-deny record next to the run that asked.

Why

Three answers that arrive too late

  • Implicit

    The policy is whatever the code does.

    Access rules live scattered across prompts, service configs and someone's memory. Nobody can state what an agent may touch without reading four repos.

  • Advisory

    Review meetings are not enforcement.

    A rule agreed in a doc stops nothing at runtime. The agent still holds the credential and still makes the call.

  • Unprovable

    Audit asks, and there is no answer.

    Showing that an agent never touched customer data means reconstructing it from logs that were never designed to prove a negative.

How it works

One policy, enforced at the gateway

  1. 01 · Declare

    Write the rule down once.

    Policies are versioned documents with an owner (which agents, which resources, which actions), not comments spread across services.

  2. 02 · Bind

    Attach it to an identity.

    Every agent runs under a named identity. A policy binds to that identity, so the rule follows the agent across environments.

  3. 03 · Enforce

    Decide at the call, not after.

    The gateway evaluates the policy on every tool call and refuses what falls outside it. Nothing depends on the agent behaving.

  4. 04 · Attest

    Keep the decision.

    Allow and deny both land in the run's trace with the policy version that decided them: the record an auditor actually asks for.

Tiers

Three tiers, set per agent

  • Observe

    Enforcement
    log only
    Approval
    none
    Blast radius
    unbounded

    Rolling a policy out. You see what it would have blocked before it blocks anything.

  • Enforce

    Default
    Enforcement
    deny
    Approval
    on escalation
    Blast radius
    scoped

    Agents doing real work against real systems. What you get if you set nothing.

  • Sealed

    Enforcement
    deny
    Approval
    human, per call
    Blast radius
    single resource

    Regulated data and irreversible actions. Slow on purpose.