What are the best tools to control what an AI agent is allowed to do?

Match the tool to the problem

• Model guardrails: evaluate or constrain model inputs and outputs. A refusal in one interface does not establish that another tool path is blocked.
• Identity and isolation: limit the accounts, files, networks and operations an agent can reach. Restricted credentials reduce the damage possible even outside the policy integration.
• Runtime enforcement: decide whether a specific proposed action may proceed, must wait for review or must be blocked. Place the check at the actual tool or business-action boundary.
• Evidence and investigation: retain decisions, reports and available external references so someone can reconstruct an incident. Recording alone does not prevent an action.

These are complementary capabilities, not necessarily four separate products. An API gateway or workflow service may already provide some controls; check its actual action context and review workflow before adding another component.

Questions to ask before choosing

1. Where is enforcement? Can the same operation use an unconnected tool, direct API call or alternate credential?
2. What can the rule evaluate? Verify agent identity, resource, destination and normalised amounts against your real request format—not a feature-list promise.
3. What happens on uncertainty? Test a timeout, a missing field and an unresolved review. Check the selected SDK and configuration; do not assume a universal fail-open or fail-closed default.
4. What is the latency budget? Measure policy evaluation separately from network time, council review and human waiting time.
5. Can an operator investigate? Find the decision reason, reported outcome, available external confirmation and integrity result for one activity. Identify missing evidence explicitly.
6. Who owns the control? Name the policy owner, permitted reviewers and the person responsible for testing integration coverage after changes.

Where HaltState fits

HaltState checks connected actions against policy before your application executes them. Policy comes first; eligible unresolved requests can go to the council, and unresolved council reviews go to a human. Rules explicitly requiring human approval still require a human.

Python, TypeScript/JavaScript, Go, Java and Rust SDKs are available. Use the documented release and integration guide for the features you need. The application's enforcement wiring, identity and network controls remain part of the system.

New Proof Packs require signatures. Investigation also includes other activity records, and a signed reported outcome is not independent confirmation of delivery or settlement. Inspect the evidence model and verified example.

Evaluate one action before expanding

Choose a refund, customer message or business-system write. In a test integration, exercise a permitted request, a prohibited request and a held request without sending a real payment or customer message. Inspect your account's investigation view and verify that the action did not run while blocked or pending.

The public Live Board is a synthetic retail demonstration, not a feed of your private account's activity. Use the policy go-live checklist to turn your evaluation into explicit launch criteria.

Related questions