Decide what an AI agent may do — before it does it.
Agent Assembly evaluates the actions you route through it against your policy, refuses them, or blocks them pending a decision, and records what it decided. An action you have not routed through it is not inspected — and the record says so.
In one sentence: Agent Assembly is a decision point you place in front of an AI agent’s actions, plus the evidence trail that shows what it decided. An agent with a shell tool and a database credential can drop a production table. One with a model-provider key can paste it into a request. One in a retry loop can keep spending until somebody notices the bill. None of those is a malfunction — each is an agent doing what it was asked, with the authority it was handed. Frameworks make agents capable — they plan, call tools, and act. But they don’t give an agent an identity, constrain its authority, or keep credentials out of the model’s reach. Agent Assembly adds that boundary without you rewriting your agents’ logic — though the agent does have to be launched through a governed path for the boundary to apply. The result is a team that can describe what an agent is supposed to do and cannot show what it is allowed to do. Logs and traces answer that question afterwards, which is the wrong moment: by the time a request appears in a trace, the request has been sent. Policy is versioned YAML or JSON you review through the Git workflow you already use. Each card below carries the term for what the product actually did to the action, and the bound that travels with it. They do not all reach the same distance, and the ones that reach least far say so rather than borrowing the confidence of the rest. A connection made on a path you routed through Agent Assembly is checked against the destination list you configured and refused before the proxy dials it. One destination rule is on by default and no configuration relaxes it: requests to loopback, private, link-local and related address space are refused, including where a public hostname resolves into them. Where this stops. Your own lists are empty until you write them, and the refusal is the proxy’s own local configuration rather than a control-plane decision. The proxy is a released artifact on Linux and a cargo install on macOS; on Windows there is no local mediation, so there is nothing in front of the connection to refuse it. An MCP tool call can be checked against your policy by the control plane and refused before the proxy forwards it. Where this stops. This is the one refusal in the product that the control plane itself decides ahead of the network, and it is off until an operator turns it on. It reaches MCP sent as an ordinary HTTP POST on an intercepted host with a gateway endpoint configured. Tool servers you run over standard input and output — the most common setup — over server-sent events, or over WebSocket have no interception mechanism. A tool call through a wrapped framework seam is checked before the tool body runs. Where this stops. The SDK is advisory by design — a defence-in-depth posture, not the authoritative gate, and an agent that does not call it is not asking. Python raises before the body and fails closed; Go fails closed but needs the wrap to be requested explicitly; the Node SDK’s default mode routes the check through a client that allows everything, so no refusal is produced there at all. Asking for enforcement without a check-capable mode is refused loudly at start-up rather than silently allowed. On the model-provider hosts Agent Assembly inspects, a recognised credential is removed from the request before it is forwarded. Where this stops. Three built-in hosts, because payload inspection is limited to model-provider hosts by default. The default action is redact and forward, not refuse — blocking on a detected credential is something you opt into. Recall is bounded by the pattern set, and model responses on that path are not scanned. A policy can declare a spend cap, per agent or across a team. Where this stops. Whether a declared cap is checked in the decision path is not established by any evidence row, so the honest term for the enforcement is Unmeasured — the claim above is about what a policy can declare, not about what stops a call. A cap exists only where a policy declares one, an undeclared budget is uncapped, and a budget store that cannot be read resets the cap silently. A policy rule can hold an action instead of answering it. The hold is real and it fails closed: the check blocks, and a timeout resolves to a refusal. Where this stops. Stated here as an unfinished capability, because that is what it is. No shipped operator surface can answer the queue the hold blocks on, so in practice it blocks and then refuses at the timeout with no person involved. Do not plan on human review yet — tracked as AAASM-5657. A capability that exists but is off is a different product from one that is on. Two of these are stronger than an evaluator usually expects, and the third is the one most often left out of a comparison because it cuts the other way. Launching a session with no policy — refused aasm run will not start a tool when no effective policy resolves, and will not start one whose policy parses but declares no rule. An absent policy is not permission, and an empty policy is unconfigured rather than allow-all. Both refuse before anything launches. Private-address egress — refused, always An agent handed a link to a cloud metadata address, or to an internal hostname that resolves into your own network, is refused before the proxy dials. The guard re-checks each resolved address rather than the name, so a public hostname that resolves into private space is refused too. No configuration and no environment variable relaxes it. An action matching no rule — allowed Once a policy is in force, an action matching no network, tool, capability or approval rule is allowed. Default-open within a policy, default-refuse on having one — both halves, or the pair misleads. They are not an ordered chain. One does not cover for another, and a component you have not deployed is reported as absent rather than quietly picked up by the next one. That inference — the checkpoint did not see it, so something underneath must have — is the specific error this product’s architecture exists to stop. The strongest of the three. It refuses at connection time, re-checks the host inside the tunnel, blocks or removes recognised credentials, and adjudicates MCP tool calls — each of those returns before it dials upstream. This is refusal that happens before the action, out of the agent’s own process. A released artifact on Linux; on macOS it is a cargo install. On Windows there is no local mediation of any kind. It wraps your framework’s tool seam and raises before the wrapped tool body runs, which is the earliest point inside your own code that a decision can be applied. Deliberately advisory: a defence-in-depth posture rather than the authoritative gate. An agent that does not call it is not asking, and a framework nobody has adapted is outside the wrapper. Platform-specific, and where they exist today they mostly observe. On Linux, kernel probes report TLS plaintext, process execution and file activity, and no such signal takes part in any allow or deny decision. macOS has no equivalent adapter — and is simultaneously the only platform on which the host-enforcement rung is reachable at all, through an opt-in, authorized settings write. Both halves are true and both are required. That rung is recorded as unearned at the published v0.0.1-rc.6 tag, because the evidence it rests on postdates that tag. Windows has neither. And the control plane? It holds your policy, budgets, approvals and audit — and it holds no traffic. Its answer stops an action only where one of the three above is waiting in front of that action for it. This is why routing comes first: a decision with nothing in front of the action is a record, not a refusal. The six roles, and which of them can actually stop something → An agent’s first mistake normally surfaces in a bill, a log or an incident review — after the call went out, when the only thing left to decide is how to respond to it. What this changes is the moment. On a path you route through Agent Assembly, with something waiting in front of the action, a call your policy refuses does not go out, and the refusal is what the record says. Off that path nothing is claimed: the record says the action was not inspected, which is a gap you can go and close rather than one you have to discover. These are on the page for a reason we would rather state than have you find: an evaluator who discovers an overstated claim after provisioning is a worse outcome than one who reads an accurate limit up front. Maturity. The open-source runtime is pre-1.0 and released as a pre-release series. The managed service is planned — decided, not built — so nothing on this page is a commitment to an availability date, a region, a service-level agreement or a compliance position. aasm audit verify-chain ships in the open-source build. It proves the integrity of the entries that are present, not that the log is whole — and emission is best-effort, so a decision can be made and its record lost. Policy is versioned YAML or JSON you review through the Git workflow you already use. The field reference is published, so a rule described on this site is a rule you can look up. Each capability sentence on this page is one of sixteen entries in a shared claim register, quoted rather than paraphrased. Every entry carries the term it reaches, the bound that travels with it, and the evidence rows behind it — including the four that carry an Unmeasured term, three of them wholly. The gateway, proxy, CLI and SDKs are Apache-2.0 on GitHub, with the tests that pin each behaviour described here. What is open source and what is not is stated rather than implied. Open-source core Self-host a limited-function stack from the Apache-2.0 crates for local evaluation and development — gateway, CLI and SDKs on any platform; the proxy on macOS and Linux; the eBPF probes on Linux. No cost. Hosted Cloud Console A managed control plane for orgs, teams, policy versioning, approvals, and audit — without running the backend yourself. The open-source core self-hosts a limited-function stack for evaluation and development; the hosted console delivers the full feature set as a managed service.Why agent frameworks are not enough
Six questions a policy answers — and how far each answer reaches
Which network destinations it may reach
Which tool calls may leave the machine
Which tools your own agent code may call
Whether a recognised credential leaves with the request
How much it may spend
Which actions are held rather than answered
Three defaults, before you configure anything
Three places, with genuinely different authority
The sidecar proxy
The SDK checkpoint
Operating-system-level controls
The moment you find out moves
What it does not do
Four things you can check without taking our word for it
Verify the audit chain yourself
Read the rule that produced the decision
Trace any sentence above to its bound
Read the runtime that makes the decision
Open-source core vs hosted Cloud Console