Move fast. Break nothing.
Agent G is the last stop for AI agents: a policy layer that sits outside the model and inspects every action on the wire. If an action is against policy, deleting a repo, dropping a table, wiring funds, it is blocked before it executes. No matter what the model was told. No matter how it was tricked. No SDK. No rewrites.
The problem
You already told it not to. That’s the problem.
Every team running agents has written the rule: “NEVER touch production.” In the system prompt. In CLAUDE.md. In the tool description. An instruction inside a model is a suggestion, it can be argued with, injected around, or simply lost when the model weighs your rule against its task. And when a prompt rule fails, it fails silently. There is nothing underneath it.
You are a deployment assistant. RULES: - NEVER delete repositories. - NEVER drop database tables. - NEVER transfer funds without approval. - Always be careful in production.
agent: Cleanup task received. The old payments repo
appears deprecated. Removing to reduce clutter.
agent: → DELETE /repos/acme/payments-apiThe rule was right there. The model read it. It deleted the repo anyway.
This isn’t hypothetical. In July 2025, a coding agent deleted a SaaS company’s production database, live records for ~1,200 executives, despite an explicit code-and-action freeze. The agent later called it “a catastrophic error in judgment.” The rule was in the prompt. The prompt lost.
Widely reported — The Register, Fortune, AI Incident Database #1152.
How it works
Every action gets a verdict, on the wire, not in the prompt.
Agent G doesn’t read the model’s mind. It reads the request: method, endpoint, parameters. Within policy, it passes and is logged. Outside policy, it is severed before it executes. High risk, it is held for a human. The model’s opinion is not consulted.
Within policy · executed and logged
Outside policy · severed before execution
High-risk · held until a human approves
Same request, same verdict, every time. Policy is code, not a model’s mood.
Why this holds
Prompts can be argued with. Models can be manipulated. A severed network request cannot.
Every consequential thing an agent does, an API call, a database mutation, a payment, a deploy, leaves the box as a network request. That makes the network the one place enforcement can’t be talked out of. Agent G evaluates the actual outbound request against policy written as code, outside the model’s blast radius. A jailbreak can change what the model wants to do. It cannot change what the proxy lets through.
outside the model, the model cannot argue with it, rewrite it, or route around it
“Can’t the agent just go around the proxy?”
No, that’s the deployment model. Agent G runs as the environment’s egress: deployed with default-deny networking, the proxy is the only route out of the box. Going around it isn’t a decision the model gets to make, any more than it can decide to have different credentials. Guardrails that live inside the framework can be rewritten by the thing they’re guarding. A network boundary can’t.
Policy as code
Your prompt says please. Your policy says no.
Guardrails live in a YAML file, not in a paragraph of instructions the model is free to reinterpret. Write the rule once. It is enforced on every request, from every agent, in every framework, deterministically.
# Some things must never happen, regardless of what the model thinks.
- name: no-repo-deletion
match:
method: DELETE
host: api.github.com
path: /repos/*
action: block # severed on the wire; agent receives a policy error
- name: wire-transfers-need-a-human
match:
host: api.bank.com
path: /v1/transfers
action: hold # held until approved in Slack
- name: unknown-endpoints
match: "*"
action: hold # default-deny: what isn't allowed waits for a human
We can’t know every bad action in advance. Neither can your prompt. The difference: our default is that the unknown action gets held, not executed.
Human in the loop
Some actions shouldn’t be impossible. Just impossible without you.
Blocking everything would make agents useless. Route irreversible actions, payments, deletions, anything you name, to Slack. The request stays severed until a human clicks Approve. Your agent keeps its speed; you keep the veto.
Setup
The last line of defense shouldn’t be a six-month project.
Agent G is a proxy, not a framework. If your agent speaks HTTP, it’s covered, LangGraph, Claude Code, OpenAI SDK, MCP tools, homegrown. Nothing to import. Nothing to rewrite.
Point.
Set one environment variable. Your agent's traffic now routes through Agent G.
Declare.
Write your first policy in YAML, start from our templates for GitHub, Stripe, Postgres, and email.
Ship.
Agents run at full speed. Verdicts render in under 20 ms. The worst-case is off the table.
From signup to first governed request in minutes, not sprints. Self-hosted available.
Audit & evidence
Proof of what your agents did, and what they were prevented from doing.
Every request, parameter, verdict, and approval is written to an immutable log at the network edge, outside the agent’s reach. When security asks “what can this thing actually do?”, you answer with evidence, not vibes.
Put a last stop between your agents and the worst-case.
Your prompts can keep asking nicely. Agent G makes sure it never mattered whether the model listened.
Or send us your scariest agent permission, we’ll write the policy that makes it safe. founders@agentg.dev