Agent Security is a policy layer between the agent runtime and integrations (email, tickets, APIs).
The runtime plans a tool call. The decide API evaluates it before side effects: allow, deny, or pending. Allow executes. Deny blocks. Pending goes to a human-in-the-loop queue. Decisions land on an append-only audit trail.
Agents plan tool calls. Agent Security sits between the runtime and integrations (email, tickets, APIs). Each call hits the policy engine (decide API) before side effects run: allow, deny, or pending.
Allow executes the tool. Deny blocks it. Pending goes to a human-in-the-loop approval queue. Every decision is recorded on an append-only audit trail (workspace events, export later).
