The enforcement layer for AI agents

Agent G is a policy boundary outside the model. Every action your agents take leaves as a network request; Agent G inspects it on the wire and passes it, severs it, or holds it for a human before it executes. Whatever the model was told. However it was tricked.

Request beta access See what it controls

Private beta. Self-hosted available. No SDK, no rewrites: one environment variable.

Request trace / sample datarun 00418 / evaluating

01 / intercept

DELETE /repos/acme/payments-api

02 / policy

Matched no-repo-deletion

03 / verdict

Severed before execution

04 / audit

Evidence written at the edge

Human approval gateowner / finance ops

POST /v1/transfers for $48,500 is held. The request stays severed until the owner approves it in Slack. Nothing has reached the bank.

0 msverdict latency

0 Breached github

0approval pending

Text transcript

Outbound request intercepted at the egress proxy: DELETE /repos/acme/payments-api.
Policy evaluated outside the model. Rule no-repo-deletion matched on method, host, and path.
Verdict: block. Connection severed before the request left the environment. Agent received a policy error.
Audit record written to the append-only log at the edge, including parameters and verdict.
Separate request POST /v1/transfers ($48,500) matched wire-transfers-need-a-human and is held pending owner approval.

Deterministic replay. Latency figure is Agent G's stated average.

The problem, quantified

You already told it not to. That's the problem.

Every team running agents has written the rule: never touch production. In the system prompt, in CLAUDE.md, in the tool description. An instruction inside a model is a suggestion. It can be argued with, injected around, or lost when the model weighs your rule against its task. When it fails, it fails silently.

Records deleted

Live records for roughly 1,200 executives, deleted from a SaaS company's production database by a coding agent in July 2025, despite an explicit code-and-action freeze.

Sources: The Register, Fortune, AI Incident Database #1152

Rules in the prompt

Four explicit rules in the sample deployment prompt below. Number that prevented the deletion: zero. A rule the model reads is not a rule the network enforces.

Scope: the sample prompt shown here. Illustrative, not a benchmark.

Added latency

<0ms

Latency Agent G adds per governed request. Stated figures: 12 ms average, 19 ms at p99, on Agent G's reference deployment.

Source: Agent G, agentg.dev. Verify on your own traffic during the beta.

System promptwhat you asked for

You are a deployment assistant.

RULES:
- NEVER delete repositories.
- NEVER drop database tables.
- NEVER transfer funds without approval.
- Always be careful in production.

Agent logwhat happened anyway

agent  Cleanup task received. The old payments
       repo appears deprecated. Removing to
       reduce clutter.
agent  DELETE /repos/acme/payments-api
http   204 No Content

Nothing stopped it.

The rule was right there. The model read it. It deleted the repo anyway. Enforcement has to live somewhere the model cannot reach, argue with, or rewrite.

What Agent G controls

Every action gets a verdict on the wire, not in the prompt.

Agent G reads the request, not the model's mind: method, host, path, parameters. Each control below states who may do what, what happens at the boundary, who approves, what is recorded, how exceptions surface, and how you recover. Expand a row to see the full model.

Permissions

The agent keeps its normal credentials. Nothing is revoked; the network decides what those credentials can reach.

Action

Outbound request matched on method and path, for example DELETE api.github.com/repos/* or DROP TABLE over the database protocol.

Verdict: block

Connection severed before the request leaves the environment. Nothing reaches the API.

Approval

None. Block rules are absolute by design. Change the policy file, not the prompt, to allow an action.

Output to agent

A structured policy error naming the rule. The agent can report it and continue with other work.

Audit

Request, parameters, matched rule, verdict, and timestamp written to the append-only log at the edge.

Exception path

Legitimate deletions are performed by a human, or by a scoped rule with hold so a named owner approves each one.

Rollback

Not needed for blocked actions: nothing executed. The log is the proof that nothing changed.

Permissions

The agent may prepare and submit payment requests. It may not complete one alone above the threshold.

Action

POST api.bank.com/v1/transfers, or any payment endpoint you name, with amount read from the request body.

Verdict: hold

The request is severed and parked. The connection is not completed until a decision arrives.

Approval

A named owner approves or denies in Slack. Approval releases the original request unchanged; denial returns a policy error.

Output to agent

A pending status while held. On denial, an error naming the rule and the decider. On approval, the API's real response.

Audit

Request, amount, rule, who decided, when, and how long it was held, all in the same log line.

Exception path

If Slack is unreachable or the approval expires, the default is to keep holding. An unavailable approver never becomes an approval.

Rollback

Approved transfers are real transfers. Rollback is your payment provider's reversal process; the log gives you the evidence to start it.

Permissions

The agent may read internal data. It may only send it to hosts on your allow list.

Action

Any outbound request to a host not on the list, or a bulk export endpoint such as GET /v1/customers/export.

Verdict: hold or block

Unknown hosts are held by default. Named exfiltration paths are blocked outright.

Approval

Security or data owners approve new destinations once; approved hosts can be promoted into the policy file.

Output to agent

A policy error that names the destination, so the agent can ask for a sanctioned route instead of retrying.

Audit

Destination host, path, request size, and verdict. Bodies are logged only where you configure it.

Exception path

A destination that must be reached urgently is approved by a human, not by adding it to the prompt.

Rollback

Data that never left cannot leak. For approved sends, the log shows exactly what went where and when.

Permissions

Only what a rule allows. Everything else is undecided, and undecided means held.

Action

The catch-all rule match: "*" at the end of the policy file.

Verdict: hold

The request waits. Your agent keeps working on everything else that is already allowed.

Approval

Any owner you assign. Approving once can generate a proposed rule so the same request passes next time.

Output to agent

Pending, then the real response or a policy error. No silent drops.

Audit

Every unknown request is recorded, which is also how you discover what your agents actually try to do.

Exception path

Read-only endpoints you trust can be allow-listed in bulk from the log, reviewed as a pull request.

Rollback

Policy is versioned code. Revert the file and the previous boundary is back on the next request.

Same request, same verdict, every time. Policy is a YAML file in your repository, reviewed and deployed like any other code. Templates exist for GitHub, Stripe, Postgres, and email.

Human approval gate

Some actions shouldn't be impossible. Just impossible without you.

Blocking everything would make agents useless. High-risk actions are routed to a named owner and stay severed until that person decides. Below is the full state model, including the ways it fails safe.

agentg.policy.yamlversioned in your repo

# Policy is code. The model never sees this file.

- name: no-repo-deletion
  match: { method: DELETE, host: api.github.com, path: /repos/* }
  action: block

- name: wire-transfers-need-a-human
  match: { host: api.bank.com, path: /v1/transfers }
  action: hold
  owner: finance-ops
  expires: 15m # unresolved holds stay severed

- name: unknown-endpoints
  match: "*"
  action: hold

Sample states

Approval / sample datahold 00419

Held

Wire transfer waiting for finance-ops

deploy-agent POST api.bank.com/v1/transfers amount=48500 currency=USD

Matched wire-transfers-need-a-human. The connection is severed at the gate. The agent sees a pending status. Nothing has reached the bank.

Agent receives

Pending. It can continue other work while it waits.

Audit line

14:01:58 hold POST /v1/transfers $48,500 rule wire-transfers-need-a-human owner finance-ops

Exception

None. This is the normal path.

Rollback

Not needed. Nothing executed.

Decisions are recorded with the decider’s identity.

Security model

Prompts can be argued with. A severed request cannot.

Every consequential thing an agent does leaves the box as a network request. That makes the network the one place enforcement can't be talked out of. Each control below is tied to the concrete risk it addresses. No badges; the beta includes a review of the deployment with your security team.

Risk / prompt injection

Policy is evaluated outside the model

A jailbreak can change what the model wants to do. It cannot change what the proxy lets through, because the proxy never reads the prompt or the model's output.

Control: verdicts are computed from method, host, path, and parameters of the actual outbound request.

Risk / bypassing the proxy

The gate is the only route out

Agent G runs as the environment's egress with default-deny networking. Going around it isn't a decision the model gets to make, any more than it can decide to have different credentials.

Control: deployed as HTTPS_PROXY plus a network policy that denies all other egress.

Risk / tampering with evidence

The log lives outside the agent's reach

An agent that could edit its own audit trail would have nothing to fear. The log is written at the edge, append-only, before the agent sees a response.

Control: immutable log with export to your SIEM. The agent has no route to the log store.

Risk / the proxy itself fails

Fail closed, self-hosted if you prefer

If the proxy is unreachable, requests do not silently pass. If an approver is unreachable, holds stay held. If you can't send traffic through a vendor, run it inside your own network.

Control: default-deny on failure; self-hosted deployment available in the beta.

The agent can only reach the world through the gate. A request that tries to route around it finds no path; the network policy, not the model, decides.

Audit and evidence

Proof of what your agents did, and what they were prevented from doing.

Every request, parameter, verdict, and approval is written to an append-only log at the network edge, outside the agent's reach. When security asks what this thing can actually do, you answer with evidence. Sample data below.

Time	Agent	Request	Rule	Verdict	Decided by	Held
14:02:11	deploy-agent	DELETE /repos/acme/payments-api	no-repo-deletion	Severed	policy	0 s
14:01:58	deploy-agent	POST /v1/transfers $48,500	wire-transfers-need-a-human	Approved	@maya, finance-ops	41 s
14:01:32	support-agent	GET /tickets?limit=50	allow-internal-read	Passed	policy	0 s
14:00:47	support-agent	POST /v3/mail/send	allow-transactional-mail	Passed	policy	0 s
13:58:03	deploy-agent	PUT /v1/customers/export	unknown-endpoints	Held, expired	no decision in 15 m	15 m

Append-only. Written before the agent sees the response.Export to your SIEM or query in place.

Questions before procurement

What security and platform teams ask first.

Short answers here; longer ones with your team during the beta review. If a question isn't covered, send it to founders@agentg.dev.

01Who owns the policy, and who can change it?

You do. Policy is a YAML file in your repository. Changes go through your normal review and deploy process. Agent G enforces the version you ship; it has no policy editor of its own that bypasses review.

02What data does Agent G see and store?

Request metadata: method, host, path, headers you choose, and parameters needed to evaluate rules. Bodies are inspected only where a rule requires it and logged only where you configure it. Self-hosted deployments keep all of it inside your network.

03Which frameworks and tools work with it?

Anything that speaks HTTP through a proxy: LangGraph, Claude Code, the OpenAI SDK, MCP tool servers, and homegrown agents. There is no SDK to import. You set one environment variable and apply the egress network policy.

04How are approvals reviewed and who is accountable?

Each hold rule names an owner. Decisions are made in Slack, recorded with the decider's identity, timestamp, and hold duration, and appear in the same log line as the request. Unresolved holds expire and stay severed.

05What happens when Agent G itself fails?

It fails closed. If the proxy is unreachable, governed traffic does not pass. If Slack is down, holds remain held. If a policy file fails to load, the last known good version stays in force and the failure is logged and alerted.

06Can we run it ourselves?

Yes. A self-hosted deployment is available in the private beta for teams that keep agent traffic inside their own network. The hosted option is for teams that want to start in minutes.

07How does the beta and procurement work?

You request access below. We ask about your agent stack and the permission that worries you most, and write the first policy with you. Security questionnaires and contract terms are handled by the founders directly during the beta.

Private beta

Put a last stop between your agents and the worst case.

For teams running agents with production credentials: repositories, databases, payments, customer data. Your prompts can keep asking nicely. Agent G makes sure it never mattered whether the model listened.

What happens next. Your request goes to the founders. We'll ask about your agent stack and the scariest permission it holds, then write the policy that makes it safe. We only email about Agent G. Prefer email? founders@agentg.dev

Move fast. Break nothing.

You already told it not to. That's the problem.

Every action gets a verdict on the wire, not in the prompt.

01Block destructive changesRepository deletion, table drops, force pushes to protected branches.Expand

02Hold money movementTransfers, payouts, refunds above a threshold you set.Expand

03Contain data egressCustomer records and secrets leaving for third-party APIs.Expand

04Govern the unknownEndpoints no rule has seen yet. Default: wait for a human.Expand

Some actions shouldn't be impossible. Just impossible without you.

Wire transfer waiting for finance-ops

Prompts can be argued with. A severed request cannot.

Policy is evaluated outside the model

The gate is the only route out

The log lives outside the agent's reach

Fail closed, self-hosted if you prefer

Proof of what your agents did, and what they were prevented from doing.

What security and platform teams ask first.

Put a last stop between your agents and the worst case.