AI agent runtime security that decides each tool call before it runs.
AI agent runtime security is the check that decides an agent's action at the moment it happens. Praesidia makes that check on each governed tool call, from which agent is asking to what the arguments say. Once you set a policy to enforce, it can deny the call or hold it for a person.
- 10:42:24Invoice agentpayments.refund €8,250 · C-1182held86d0 7b21
- 10:42:20Support agentcrm.export_customers 40,000 customersdenied887d 0292
- 10:42:13Unregistered callera2a → Invoice agentdenied8a2a 8a03
- 10:42:07HR assistanthris.read salary fieldsdenied1b17 1174
- 10:42:01Sales copilotmodel call routed to an EU modelallowed1cc4 98e5
- 10:41:58Claims assistantemail.send external domaindenied1e71 2056
- 10:41:49Coding agentgithub.create_pull_requestallowed5f09 e1c7
- 10:41:40Research agentweb.fetch pastebin.comdenieda4e8 3b90
- 10:41:33Support agentreply.send card number redactedallowedd231 77fa
Observe is the default. New policies are evaluated on each governed call while the call goes through unchanged, and Praesidia records the decisions it makes. Denials and holds apply once you set a policy to enforce; the stream above shows enforce mode. Approving a held call is in every plan; multi-step approval workflows are Enterprise.
- Who
- Support agent, on its own identity
- What
- crm.export_customers, 40,000 customer records
- Target
- The CRM, through its governed connection
- Policy
- More than 1,000 records is a restricted bulk export
- Decision
- Denied, before the call reaches the CRM
- Result
- Nothing exported; the agent is told the call was refused
- Proof
- The decision is signed into the audit trail, with its Decision Receipt
The denial applies once the policy is set to enforce. In observe mode the same export is recorded against the rule and goes through. What a Decision Receipt holds.
Six checks between an agent and the tool
The action and its arguments reach Praesidia before they reach the tool, and six checks stand between them.
- 1
Identity. Each call is tied to one agent's own short-lived credential, and revoking the agent withdraws it.
- 2
Connection. The connection decides which tools are reachable. A deny wins over any allow.
- 3
Arguments. The tool policy reads the call itself: amount > 500 is a rule you write.
- 4
Sequence. Sequence rules see what came before: an export, then an email out, inside ten minutes. Advanced
- 5
A person. If a rule says so, the call becomes an approval request waiting on a named person.
- 6
Record. Allowed or not, Praesidia records the decision in an append-only, hash-chained audit trail, signed under the default configuration.
Observe first, enforce when the record says you can
A new control does not have to start by blocking. Roll it out in four stages, and move it forward only when the decisions it records look right.
- Simulate
- Replay past traffic through the rule. Nothing live changes. Advanced
- Observe
- Evaluated on every live call; the call goes through unchanged, and Praesidia records the decisions it makes. Default
- Alert
- Matches notify your team while the traffic keeps flowing.
- Enforce
- The same rule can now deny the call or hold it for a person.
The controls behind the stream
Each one is a runtime capability. Plan-gated ones carry their plan; the scenarios in them are illustrative.
-
Freeze everything, after you see what stops
One step halts your organization’s agent traffic. First, a preview lists every AI system that will stop, several hops out through the dependencies.
Illustrative preview below -
Sequence rules
Catch the dangerous pattern, not just the single call.
WHEN crm.export_contacts THEN email.send to an external domain WITHIN 10 minutes DECIDE deny
Advanced Illustrative rule -
Replay before you enforce
Run last week’s real traffic through a new security policy, guardrail or sequence rule and see exactly what it would have stopped, before it touches a live call.
Would have denied 37 of 18,420 calls, 31 from one agent.
Advanced Illustrative result -
24 guardrail templates
Personal data, payment cards, secrets, prompt injection, jailbreaks and more, checked on the way in and the way out. Each match can block, warn, redact, replace, retry or escalate.
Rule-based guardrails in every plan; ML guardrails from Individual; LLM-judged guardrails on Advanced.
-
Your keys, one gateway URL
Through the gateway's one base URL or as an agent's configured model, from the same list on both paths: OpenAI, Anthropic, Azure OpenAI, Google Gemini, Mistral AI, Cohere, DeepSeek, Qwen, Moonshot, a self-hosted Ollama, or your own OpenAI-compatible endpoint. Spend caps are checked before a call leaves, an organization freeze stops model traffic too, and the outside domains your agents’ tools reach can be allowed or denied.
# point the agent's client at the gateway client = OpenAI( base_url="<your Praesidia gateway URL>", api_key="<agent key>") -
Model routing by data class
An agent’s model call goes to a model that fits the data’s classification, residency and risk tier: the cheapest one that qualifies, with a fallback when a provider is failing.
Personal data of EU customers, EU region only, a model approved for personal data: routed to the cheapest qualifying EU model.
Illustrative
Unfreeze item by item when you are ready.
The rule behind a held refund
Not the tool name alone, but the argument that makes the call consequential, and the named person it waits on.
Rules evaluated by priority
Tool access rules per agent, scoped to one MCP server or all of them. Without a matching allow rule, a governed tool call is denied. This one sends any refund above 500 to a person first.
Held for a named person
The step-up rule turns the call into a durable approval request: who asked, for what, and when it expires if nobody answers. The approval is written into the record either way. Approving a held call is in every plan; multi-step approval workflows are Enterprise.
Numbers you can count yourself once you are inside
What each control does, and where it stops
Including how the enforcement path behaves when something degrades.
- Two layers of rules
-
Connection rules apply to every governed tool call: allow or deny by tool name or pattern, constrain argument values, cap calls per hour, expire the permission. Deny wins.
Agent tool policies are where enforcement is your decision. In observe mode the rule is evaluated and recorded and the call goes through unchanged; in enforce mode the same rule can deny it or send it to a person.
- Sequence rules and replay
- A sequence rule matches one action followed by another within a time window, in the live decision path. Policy replay runs a security policy, guardrail or sequence rule against historical traffic and reports what it would have denied. Both are on the Advanced tier and Enterprise; governance packs for OWASP Agentic, healthcare and financial services give you a starting set.
- Human approval
- A step-up rule turns the call into a durable approval request that expires if nobody answers. It applies in enforce mode. Approving a held call is in every plan; multi-step approval workflows are Enterprise.
- Containment
-
- Freeze the organization. One step halts agent traffic after a preview of every AI system that stops; unfreeze item by item.
- Quarantine, reversible. Withdraws the agent's live task credentials and cancels its in-flight tasks, up to a fixed limit each time; the identity survives.
- Suspend. Takes an agent out of service without tearing anything down.
- Revoke the identity, irreversible. Its credentials stop working for good.
- Block one tool, for one agent. Leaves the rest of its access where it is.
- Disable an MCP server. Turns off a whole server for everyone at once.
- Disconnect an agent from a server. Leaves every other connection untouched.
- Where containment stops
- Containment covers what Praesidia mediates: governed tool calls, connections and credentials. One delay worth stating plainly: once an agent is quarantined or revoked, new model calls through the gateway with its application key are refused within about a minute, at the gateway's next policy refresh; requests already running finish, and a streamed response can last up to 10 minutes. Its budget and egress policy still apply in that window.
- Reliability
-
By default, if the enforcement point cannot reach the control plane, governed calls are refused rather than let through unchecked. Policy denials are separate: they apply only once a policy is set to enforce, and new policies start in observe mode.
A revoked key can keep working at the enforcement point for a short window — minutes, not hours. If the control plane is slow to answer, a governed call is not left hanging: by default it is refused within seconds.
- Measured overhead
-
Proxy overhead p50 0.332 ms · p90 0.927 ms · p99 3.39 ms.
From our own release measurement, under the conditions it states: pure-passthrough baseline; rule-based guardrails only; ML/LLM guardrails opt-in & excluded. It was measured on a single host against an in-process upstream over 3,000 iterations; treat it as the floor our proxy adds, not as a prediction for your network.
Read the docs: guardrails · connections · policies. Then: MCP server governance · the AI System Graph · incident response · evidence · verify the evidence yourself.
New policies start in observe mode: decisions are recorded, nothing is blocked. Denials and holds apply once a policy is set to enforce. Approving a held call is in every plan and multi-step approval workflows are Enterprise; policy replay, sequence rules and governance packs are on the Advanced tier and Enterprise. Streams, rules and previews marked illustrative are examples, not customer data.
Common questions about AI agent runtime security
It is the control that decides an agent's action while it is happening, rather than reviewing the agent's design beforehand or its logs afterwards. Praesidia makes that decision on each governed tool call: the agent's identity, the tool's permission on that connection, the arguments, and, on the Advanced tier and Enterprise, what the agent did just before.
No. New policies are evaluated on each governed call while the call goes through unchanged, and Praesidia records the decisions it makes. Denials and holds apply once you set a policy to enforce. Replaying past traffic through a rule before you enforce it is on the Advanced tier and Enterprise.
Approving a held call is in every plan; multi-step approval workflows are Enterprise. A held call waits on a named person, expires if nobody answers, and applies in enforce mode.
By default, if the enforcement point cannot reach the control plane, governed calls are refused rather than let through unchecked. A revoked key can keep working at the enforcement point for a short window, minutes rather than hours.
Quarantine it: its live task credentials are withdrawn and its in-flight tasks cancelled, up to a fixed limit each time, and it can be restored later. Revoke it to end its identity for good, or freeze the whole organization after a preview of every AI system that will stop. Once the agent is quarantined or revoked, new model calls through the gateway with its application key are refused within about a minute, at the gateway's next policy refresh; requests already running finish, and a streamed response can last up to 10 minutes. Its budget and egress policy still apply in that window.
Our own release measurement put proxy overhead at 0.332 ms p50, 0.927 ms p90 and 3.39 ms p99, with rule-based guardrails only, on a single host. Treat it as the floor the proxy adds, not a prediction for your network.
Go deeper
- The AI agent security guide — the threats, the controls and where runtime enforcement fits.
- Human-in-the-loop approvals — when a high-risk action should wait for a person.
- Staged rollout and shadow mode — observing a rule before it blocks anything.
- Rogue agents and kill switches — containment, step by step.
- EU AI Act controls for AI agents — human oversight and logging, mapped to Praesidia's controls.
- Kill switch and agentic AI security, defined in the glossary.
Put one agent under a rule and watch it work
Start in observe mode. Read the decisions. Then enforce.