How It Works

AgenticGuard is a transparent security layer that intercepts every tool call an AI agent makes.

Architecture

  Your AI Agent
       │
       │  HTTP call (via proxy URL or SDK)
       ▼
  ┌─────────────────────────────┐
  │       AgenticGuard          │
  │                             │
  │  1. Authenticate agent      │
  │  2. Check policy rules      │  ──► Deny → 403 + audit log + Slack
  │  3. Inject credentials      │
  │  4. Forward request         │  ──► External API / Tool
  │  5. Log outcome + latency   │
  └─────────────────────────────┘
       │
       │  Response
       ▼
  Your AI Agent

Request lifecycle

1. Authentication

Every request carries an agent API key — either in the proxy URL path or the X-Agent-Key header. AgenticGuard verifies the key hash against the database and resolves the associated organization.

2. Policy evaluation

The policy engine loads YAML rules for the agent. Rules are evaluated in order; the first match wins.

rules:
  - tool: github
    action: DELETE
    decision: deny         # hard block

  - tool: "*"
    action: POST
    require_reasoning: true  # allow, but reasoning must be present

If a rule denies the call:

• The request is not forwarded
• A 403 response is returned immediately
• The event is written to the audit log
• A Slack notification is sent (if configured)

3. Credential injection

AgenticGuard looks up stored credentials by hostname. If the target URL matches a credential, the secret is injected into the outgoing request — as a Bearer token, a custom header, or a query parameter. Your agent code never sees the raw credential.

4. Request forwarding

The request is forwarded to the target URL using an async HTTP client with a 30-second timeout. Hop-by-hop headers (Connection, Transfer-Encoding, etc.) are stripped before forwarding and before returning the response.

5. Audit logging

Every call — allowed or denied — is written to the audit log with:

• Timestamp and latency
• Agent ID and organization
• Tool name (derived from target hostname)
• Decision (allowed / denied)
• Agent-provided reasoning and task ID
• HTTP status code from upstream

Data model

Organization
  ├── Agents (API keys)
  ├── Credentials (encrypted secrets)
  ├── Policies (YAML rules per agent)
  └── Audit Events (immutable log)

Security properties

Property	Implementation
Credential encryption	AES-256-GCM, per-org key
API key storage	SHA-256 hash only; plaintext shown once
Audit log	Append-only; no delete API
Multi-tenant isolation	All queries scoped to organization_id
TLS	HTTPS enforced in production