How an agent action actually gets governed.
This is the runtime path inside Guardyx AI: how a tool call moves from interception to execution, with every decision captured. It's the part your engineers will care about.
The runtime path
Intercept
Route every tool call through Guardyx AI before it executes.
Evaluate
Run policies using context like user, tool, payload, and risk.
Approve
Require human approval for sensitive actions.
Trace
Capture inputs, decisions, and outcomes for every run.
Execute
Perform the action only after policies and approvals pass.
ReplayComing soon
Re-run scenarios to debug behavior and validate guardrails.
The surface your team operates.
Every held action lands here: what the agent tried, how risky it is, and the approve-or-deny call, before anything runs.
By default, an agent connected over MCP has to say why before a call that needs approval can be held; a call without a reason goes back to the agent to retry with one. Approvers see that reason too (in the portal, in email, and in Slack direct messages, never in channel posts), always labelled as the agent's own, unverified. Once someone decides, the Slack card keeps the tool, agent, risk and a link back to the request, so the thread still shows which request was decided.
A worked example
One high-value payment, from the agent's decision to the recorded outcome.
Execution flow
Without Guardyx AI
This sequence executes immediately: no policy checks, no approvals, no audit trail. You'd also need to build and maintain the control infrastructure yourself.
- Agent decides to initiate a $250,000 vendor payment.
- Call is routed through Guardyx AI instead of directly executing.
- Policy check runs and flags the transaction as high-risk.
- Execution is blocked and routed for finance approval.
- Finance approver reviews details and approves the payment.
- Payment executes and a full audit trail is recorded.
Execution log
Blockedrun_id: 9f3c2a1 agent: sales-agent tool: salesforce.update_opportunity status: blocked reason: requires_approval policy: external_write_requires_review
Fail-closed by default
If the policy check itself cannot complete (the policy service is unreachable, times out, or errors), the action does not run. The default outcome of an unresolved check is to stop the action, never to let it through.
Skip building it yourself
Keep your existing agents and route their actions through Guardyx AI, instead of building approval, audit, and policy infrastructure from scratch.
Every run, on the record.
The Runs Explorer keeps an attribution-first history: who kicked off each run, the person the agent acted for when it connected on their behalf, which tools it called, the policy decision, and the outcome, exportable as evidence.
Calls an agent makes over one MCP session are grouped into a single record with a timeline, so a burst of agent work reads as one piece of work, and every call in it still opens on its own.
Grant access deliberately.
The riskiest moment is when you hand an agent new power, and the next riskiest is forgetting you did. Guardyx AI shows you what you are granting, and keeps track of it afterwards.
Risk is on screen where you grant it
Every toolbox shows its risk level and action count in the pickers you use to give an agent access, so the one critical toolbox never looks like a sample.
A bulk Allow cannot sweep in a delete
Select a batch of actions on Allow and Guardyx AI stops to list every destructive one it caught: deletes, revokes, bans, archives. Route them to human approval in one click, or allow them knowingly.
Agents stop chasing tools they cannot have
Tool search leaves out actions your policy denies, so an agent's next pick is one the gate can allow. A denied tool called by name is still refused, and the attempt is still recorded.
Risky grants default to approval
Add an action without choosing a policy and Guardyx AI picks one from its risk: destructive or high-risk actions require human approval, everything else is allowed. A policy you choose is kept as you chose it.
Grants can expire on their own
Give an allowed action an expiry: 7, 30 or 90 days, or a date. From the moment it lapses, the agent is refused as if it had never been granted, and the lapse is recorded.
Two ways to connect, no rewrite either way.
Point a client at Guardyx AI (MCP)
Already using Claude Desktop, Cursor, ChatGPT, or a custom client for the Model Context Protocol (MCP)? Point it at a Guardyx AI endpoint. Guardyx AI then governs every tool call it makes, applying policy, approvals, and audit automatically. Setup is a config change, not a migration.
The Claude.ai connector, Meta Muse and Grok Bot skip the key: they sign in over OAuth, and you approve the connection on a consent screen.
Add the Guardyx AI endpoint to your client config:
{
"mcpServers": {
"guardyx": {
"command": "npx",
"args": [
"-y", "mcp-remote",
"https://app.guardyx.ai/v1/mcp",
"--header", "X-API-Key:gx_live_YOUR_KEY"
]
}
}
}Follow the MCP quickstartWrap your own agent
Running a custom Python agent, or a framework we don't ship a native adapter for? Route its tool calls through the Guardyx AI SDK and get the same controls around code you already have.
SDK (custom Python):
# before
tool.send_email(payload)
# after
guardyx.execute("send_email", payload)Not an engineer? Use quick setup.
Any member can go from choosing the app their assistant runs in to a connected, governed agent without writing config, picking tools in plain language, reusing a set their team already approved, and connecting only the accounts they are missing. In a set they build themselves, destructive actions always require human approval.
A new workspace starts here. When it can, setup ends by handing you a prompt that will be held for approval, so you watch Guardyx AI stop a real action before you rely on it.
Native adapters, live today
These are the frameworks Guardyx AI ships an adapter for right now. LangChain tools are governed through the LangGraph adapter. Anything else connects through MCP or the SDK.
- CrewAI
- Microsoft AutoGen
- Google ADK
- OpenAI Agents SDK
- Anthropic Claude Agent SDK
- LangGraph
- OpenAI tool calling (raw)
What comes out the other end
Every governed action (allowed, held, or denied) is captured with its context and decision.
Auditor-ready evidence packs
Export the record of what your agents did and what Guardyx AI decided, as a pack an auditor can read, rather than a questionnaire response you assemble by hand. Every action in the export says whether a human reviewed it, who decided, through which channel, and when, and every pack carries an embedded verification of the audit chain.
A weekly report, by email
Every Monday, admins get the workspace's week (tool calls, changes made, guardrail hits, apps and people), and each member with agent activity gets their own. The numbers match the Overview's "Last week" view. Members can opt out.
No SIEM integration today
We don't currently stream into a security information and event management (SIEM) tool or an observability platform. We'd rather say so than imply otherwise. Audit leaves Guardyx AI as an export you control.
Every AI action passes through Guardyx.
See it work on your own agents.
Point your existing agents at Guardyx AI. Connect over MCP or the SDK and route your first governed tool call without rewriting them.