Stop dangerous agent actions before they execute.
An agent's worst day is one tool call — a refund, a delete, an export — that nobody reviewed. Praesidia sits on the call itself: it checks which agent is asking, whether that tool is permitted on that connection, and what the arguments actually say. A call that breaks a rule can be held for a person or stopped before the tool ever runs.
Observe first, then enforce — record every decision without changing behaviour, then turn enforcement on once the rules read right.
What happens between an agent and the tool it wants to use
Every governed tool call goes through the same sequence. Nothing here depends on the agent behaving well.
The request arrives first
The action and its arguments reach Praesidia before they reach the tool. That ordering is the whole point: a decision taken after the refund has been issued is a report, not a control.
Identity is checked
The caller presents a short-lived capability token minted for that agent and nothing else, revocable on its own. Revoking an agent's identity takes effect at its next authorization; for model traffic the local policy cache bounds the gap, and that cache lifetime is short — minutes, not hours, and set by your operator.
The connection decides what is reachable
Each agent-to-server connection carries its own tool rules: which tools may be called, which argument values are acceptable, how many calls per hour, and when the permission expires. A deny wins over any allow.
Policy reads the arguments
A tool policy can look inside the call — not just which tool, but what it was asked to do. amount > 500 is a rule you write, and rules carry a version and a priority so you can see which one won.
A person is brought in, if the rule says so
A step-up rule turns the call into a durable approval request: it waits for a named human to approve or reject it, and it expires if nobody does. Human approval for sensitive tool calls is an Enterprise capability.
The decision is recorded either way
The actor, the action, the argument that mattered, the rule that matched and the decision land in an append-only, hash-chained record — cryptographically signed under the default configuration. Verify it yourself →
Two layers, and you choose when the second one bites
Connection rules apply on every governed tool call. Allow or deny by tool name or pattern, constrain the argument values a tool will accept, cap the calls per hour, and give the permission an expiry date. Deny wins.
Agent tool policies are where enforcement is a decision you make. In observe mode the rule is evaluated and the outcome is recorded, and the call goes through unchanged — so you can read a week of real decisions before anything is blocked. In enforce mode the same rule can deny the call outright or send it to a person.
Around both: rate limits, spend budgets, trust floors and time-of-day windows per agent and per connection; and for model traffic, a budget reserved before the call, an egress allow-list, and guardrails on the content in both directions.
A call held for a person
When a rule requires approval, the call does not fail silently and it does not go through. It waits, with the reason attached and a clock on it.
When you need it to stop now
Incidents do not wait for a policy review. These are the controls you reach for while you are still working out what happened.
Quarantine — reversible
Kills the agent's live capability tokens, cancels the work it has in flight, and unbinds the application keys tied to it. Its identity survives, so an agent cleared by the review comes back instead of being rebuilt.
Suspend
Take an agent out of service without tearing anything down, and restore it when you are ready.
Revoke the identity — irreversible
For an agent that should never run again: its credentials stop working for good, and the live tokens issued to it are revoked with them.
Block one tool, for one agent
The narrow fix. Leave the rest of the agent's access exactly where it is and deny the single call you do not want it making.
Disable an MCP server
Turn off a whole server for everyone at once when the server, not the agent, is the problem.
Disconnect an agent from a server
Cut one agent's access to one server and leave every other connection to it untouched.
Containment covers what Praesidia mediates: the agent's governed tool calls, its connections and its credentials. One exception worth stating plainly — the model gateway does not read agent status yet, so a quarantined agent's model traffic is held by its budget and egress policy rather than by the quarantine itself. Paths you have not put under control are outside that boundary — which is the argument for bringing the MCP servers under it too.
What happens when the control plane has a bad day
A security control in the request path has to answer this before anybody will put it there. Here are the answers, including the awkward one.
It fails closed
If the enforcement point cannot reach the control plane, governed calls are refused rather than waved through. That is the default, and it is the behaviour you get if you configure nothing.
A bounded way to choose availability instead
Operators who would rather stay up can turn on a time-boxed fail-open window, bounded and configured by them. Requests served while degraded are spooled durably and replayed into the audit chain afterwards, so the gap is visible rather than missing.
Staleness has a ceiling
Policy is cached close to the enforcement point. The cache lifetime is what bounds how long a revoked key could keep working — a short, bounded lifetime, minutes rather than hours, and you can shorten it.
Timeouts, not hangs
Calls from the enforcement point to the control plane time out in seconds — 5 s and 7 s — so a slow dependency turns into a decision, not a request held open.
From our own release measurement, under the conditions it states: pure-passthrough baseline; rule-based guardrails only; ML/LLM guardrails opt-in & excluded. It was measured on a single host against an in-process upstream over 3,000 iterations — treat it as the floor our proxy adds, not as a prediction for your network.
Go deeper on runtime control
Guardrails documentation
How request and response checks are configured, what they can block or redact, and what happens when one cannot be evaluated. →
MCP server governance
The same controls applied to every MCP server your agents reach: identity per server, tool-level authorization, and evidence per call. →
Verify the evidence yourself
praesidia-verify re-walks the signatures and the hash chain on your own machine, with no call back to us. →
What each plan includes
Where approvals, SSO and SIEM export sit, and what the free plan already covers. →
Put one agent under a rule and watch it work
Start in observe mode. Read the decisions. Then enforce.