Agent guards

AI agents turn model output into real actions: sending email, changing records, reading sensitive data, and calling third-party services. Those actions are triggered by a chat form, an inbox, a webhook, or a schedule, and they run across long workflows nobody watches.

Arcjet Agent guards put a deterministic check immediately before each of those actions. Developers add one enforcement point and map trusted application context into it. Security teams define the policy for that action in Arcjet, selected by its stable label. Every attempted action receives an ALLOW or DENY decision before the action runs, which makes enforcement deterministic even when model behavior is not.

Agent guards work inside tool handlers, queue consumers, and workflow steps, with no HTTP request. That’s where Arcjet can use the actor, the action inputs, and the application context that model gateways and network controls can’t reliably infer.

┌──────────┐  proposed call  ┌─────────────┐  ALLOW  ┌─────────────┐
│ AI agent │────────────────▶│ Agent guard │────────▶│ Tool action │
└──────────┘                 └──────┬──────┘         └─────────────┘
                                    │
                                    │ DENY
                                    ▼
                             ┌──────────────┐
                             │ Action stops │
                             └──────────────┘

Observe, enforce, audit

Securing an agent at runtime is three problems, and Arcjet covers each one:

Question	What to use
Which agents are running?	Observe agent activity, with no code change
Should this action be allowed?	Agent guards, at the action boundary
What happened, and why?	Decisions and capture events, recorded per action

Every decision records the policy revision and the values the policy read, so an answer can be reconstructed.

Where enforcement runs

The enforcement point runs in your application, immediately before the action runs. The decision can combine any of the following:

A remote policy, selected by the guard label and configured centrally. Its conditions are written in Rego over the inputs you map, and can read Arcjet’s own detector findings as facts.
SDK rules in code, such as rate limiting or prompt injection detection.
Local evaluation, which covers sensitive-information detection over a string that never leaves your process.

The application owns the final enforcement point. A direct guard() call returns a decision for you to act on, and a framework integration places the same check around a tool automatically.

JavaScript, Python, and Go all offer the direct guard() call. Framework integrations are available for JavaScript and Python. For how each SDK packages a helper, receives the client, and reports a denial, see How the SDKs differ.

Agent guards and request protection

Use the API that matches the enforcement boundary:

	Agent guards	Request protection
Entry point	`guard()`; `capture()` records what happened afterward	`protect()`
Protects	Tool calls, agent actions, queue jobs, workflow steps	HTTP routes and API requests
Input	`label`, optional `actor`, typed policy inputs, SDK rules	Request and request-specific rule inputs
Remote configuration	Agent guard policies, selected by `label`	Remote rules, scoped to a site

A single application can use both: request protection on its API routes, and agent guards inside its tool handlers, queue workers, and MCP tools.

Next steps

Guard one tool call Add an enforcement point before one action, end to end.

Framework integrations Compare the SDK shapes, then pick the adapter, import path, and enforcement point for your agent framework.

Policy contract Labels, actors, typed inputs, detectors, and rules.

Write policies in Rego The input document, the supported language subset, and what it excludes.

Policy examples Worked policies for email, refunds, web fetch, databases, files, and budgets.

Author and publish policies Build visually, describe in English, test, and publish.

Secure coding agents Enforce the same policies on Claude Code and GitHub Copilot tool calls, with no SDK.

Capture events Record that an allowed action happened, without changing the decision.

Testing and reference Test denial and availability behavior and review the API.