For security teams

In the data path. Every MCP tool call and every HTTP API request from your agents is evaluated before it reaches the server it is aimed at. This is the difference from an observability tool: an observability tool tells you what your agent did, after it did it.

The identity of the calling agent, the tool being called, the arguments, and the data that would leave with the call. On top of that sit detections for prompt injection, excessive agency, server impersonation and tool definition drift — the failure modes specific to agents, not to web apps.

Rules that allow, deny, or transform, scoped per agent, per tool, and per argument. Transform is the one people underuse: instead of blocking a call outright, you strip the field that should not have been in it and let the agent get on with its work.

Not every failure behaves the same way, and the distinction is the part worth reading. Access revocation checks and the audit chain fail closed: if they cannot be checked or written, the call does not proceed. When a security inspection stage itself errors, the call is forwarded and the event is recorded with the outcome fail_open — so a degraded decision stays visible in the log instead of being indistinguishable from a clean allow. You can query for that outcome.

Per agent. Policy evaluation, scoring and recording run exactly as they would in enforcement; the deny and human-review decisions are computed and logged but not applied. The audit outcome is recorded as shadow, so you can count what enforcement would have cost you before you turn it on.