One idea, pushed further down the stack: a single decision at the tool call. Here is where that stands. The security kind of surprise is the one you do not want, so we would rather show the list.
Shipped
The foundation. Wrap your agent (OpenAI Agents, LangChain, Google ADK, Pydantic AI) and every tool call is checked before it runs. Per-request user identity as a signed Biscuit token, signed WASM bundles, an audit record on every decision.
Past allow and deny: constraints on the actual arguments. Quantifiers, string functions, cross-field checks, constants, inherited roles. Two engines, one for dev and one for prod, return the same verdict.
version: 1
consts:
max_recipients: 5
prod_env: "production"
roles:
base: # shared mixin
is_mixin: true
consts: { max_recipients: 5 }
default:
inherits: [base]
default_policy: { mode: deny } # deny by default
tools:
send_email:
mode: allow
constraints:
- count(args.to) <= consts.max_recipients # count() + const
- every(args.to, endswith(., "@acme.com")) # quantifier
refund:
mode: allow
constraints:
- args.amount <= args.limit # cross-field
- matches(args.ticket, "^INC-[0-9]+$") # regex
read_file:
mode: allow
constraints:
- startswith(args.path, "/srv/") and not contains(args.path, "..")
deploy:
mode: approval_required
constraints:
- args.env != consts.prod_env or role == "admin" # or + role
admin:
inherits: [base]
tools:
deploy: { mode: allow }Two engines, one verdict: pydantic in dev, signed WASM in prod, checked at parity.
Plug into a third-party MCP server and your agent inherits every tool it ships. That is the problem. Hexgate runs each MCP call through the same policy as native tools: deny by default, an allowlist, and per-argument constraints.
Tools are auto-enumerated at connect time and namespaced, so gating an MCP tool is no different from gating a native one. Deny by default: a server that ships 50 tools cannot smuggle in the 47 you never vetted. A denied call never reaches the server.
A kill-switch. Ban an agent or a user, checked on every invocation before the model even runs, independent of policy. Revocable, with active-bans and blocked-attempts views. The natural next step after anomaly detection: spot it, then pull the plug.
Every allow, deny, and approval, plus every LLM call, logged as typed events. A dashboard to explore them: KPIs, decisions over time, a breakdown, filters (agent, role, tool, date, user), and a first anomaly-detection card.
Every policy decision · project support-bot
Preview of the platform Audit dashboard
Planned
Extend policy past tools, down to the resources a call reaches: internet egress (domains), API endpoints, and database queries (tables, read or write). An allowed tool still cannot touch a resource it should not.
Finer algorithms over the audit history: adaptive thresholds, per-user behavior profiles, drift detection, feeding an automatic policy tightening. Spot the odd one out, then narrow its rights on the next turn.
A proxy to intercept requests from agents and MCP servers you do not control in code. Same policy, same audit, no code change. The transparent twin of the SDK wrapper.
Route model calls (multi-provider, fallback, budgets) and apply input and output guardrails. The text channel, alongside the action channel we already cover.
Catch and block sensitive data (PII, secrets) leaking through inputs, outputs, and tool arguments, at the same decision point as policy.
Install the SDK and wrap your existing OpenAI Agents, LangChain, Google ADK, or Pydantic AI agent. Or book a walkthrough of the policy language, MCP gate, audit dashboard, and where the roadmap is headed.