SURFACE 02 — THE AGENT ACTION · CONNECTED TIER
The agent proposes. Policy disposes.
Deterministic guardrails that rule on every governed agent action before it executes — LLM calls, tool calls, mediated dispatch. Direct paths are not governed until routed through an enforcement point. Pre-execution evaluation against your policy. Deterministic policy—not an LLM judging an LLM—makes the enforcement decision.
MANAGED PILOT AVAILABLE · SCOPE STATED PRECISELY BELOW
DECISION RECORD — ILLUSTRATIVESIGNING / VERIFICATION · TRUST
EVENT
agent.tool_call → payments.refund
ARGS
amount: $18,400 · account: ext-9114
POLICY
agent-fin-v12 · rule: refund_cap_5k
RULING
DENY
pre-execution · illustrative, not a benchmark
sha256:9c22…b7e1 · deterministic policy decision · action never executed
PLATE P-07 — WHERE AGENTS ARE BUILT
FIG. 1 — PRE-EXECUTION AUTHORIZATION PATH
AGENT
PROPOSES AN ACTION
tool call · LLM call · dispatch — intercepted by proxy or SDK
POLICY ENGINE
CONTAINMENT
RULES BEFORE EXECUTION
canonicalize → evaluate → allow / deny / modify / step up / defer · deterministic
SYSTEM OF RECORD
EXECUTES ONLY IF ALLOWED
the action reaches the tool only after an ALLOW ruling from the in-path guard
FIG. 2 — TWO WAYS TO INTEGRATE
A proxy for the fleet, an SDK for the code you own.
OPTION A · LLM-BOUNDARY PROXY — NO CODE CHANGES
Point your agents' LLM traffic at the proxy. Every call is intercepted, evaluated against policy, and receipted before dispatch.
# one environment variable — illustrative
export OPENAI_BASE_URL=https://proxy.containment.example/v1
# traffic now intercepted · evaluated · receipted
OPTION B · SDK — GUARD THE TOOL DISPATCH
Wrap the tools your agent can call. The ruling lands between the agent's intent and the side effect. Developer preview: the SDK is not on a public package registry yet — the HTTP contract behind it is what ships today, and preview access is by request.
// wrap once — illustrative
const tools = containment.guard(rawTools, {
policy: 'agent-fin-v12',
});
// every call ruled on pre-execution
PROXY COVERS: OPENAI · ANTHROPIC · BEDROCK · AZURE OPENAI
SCOPE, STATED PRECISELY —
the proxy governs the LLM-call boundary. Direct HTTP from agent code, filesystem, shell, and raw database access are out of its scope and flagged as gaps in our AARM attestation — no silent coverage claims.
FIG. 3 — THE RULINGS, PER AARM R4
FIG. 4 — WHAT YOU GET
Pre-execution evaluation
The ruling lands before the side effect. A denied action never touches the tool, the API, or the database.
Policy as versioned code
Action envelopes, argument bounds, rate and value caps — versioned and reviewable like code. Re-evaluation requires the exact input, context, and policy bundle.
AARM-aligned
Aligned with AARM v1.0, the Cloud Security Alliance runtime-governance specification for autonomous agents.