Hi HN,

Over the past few months, we’ve been experimenting with something that kept bothering us about AI agents in production.

Most agent systems today are “fail-open”: • The model proposes an action • The tool executes • Logs are written • Monitoring happens after the fact

This works fine for demos and low-risk workflows.

It feels different when agents: • trigger payments • deploy code • modify production data • access local files • interact with real infrastructure

We started asking a simple question:

What if execution itself was policy-bound?

⸻

What we built

We built a runtime authorization layer that sits between:

LLM → Proposed Action → Policy Engine → Allow / Deny / Compute / Escalate → Execution → Trace + Replay

Instead of parsing messages or relying on post-hoc logs, we: • evaluate the proposed tool invocation • bind it to a policy (OPA-based) • gate execution before it runs • emit reproducible artifacts

Each decision produces: • policy digest • input/output hash • trace ID • optional ledger entry • replay support

⸻

What this is NOT • Not another agent framework • Not a monitoring dashboard • Not prompt-level guardrails • Not pattern extraction

It operates at the action surface.

If the agent attempts to call a tool, the call is evaluated before runtime.

⸻

Example (simplified)

If the agent tries:

fs.write_file(”/prod/config.yaml”)

Policy may: • DENY • ESCALATE (human required) • COMPUTE (force safe path) • ALLOW with constraints

The key idea:

Authorization becomes structural, not contractual.

⸻

Why we built it

There’s a growing gap between:

Model capability and System accountability

As agents move from answering to acting, the stack shifts.

We’re curious whether others are running into the same problem.

⸻

Looking for feedback

We’re currently: • running this locally via a desktop client • integrating with MCP tool surfaces • experimenting with observe-only and enforce modes

Would love thoughts from folks: • deploying agents in production • thinking about policy / governance • building infra around AI execution

Especially interested in criticism.

Happy to share architecture details.