An agent can take a sequence of individually authorized actions whose net effect is harm. Fetch untrusted content, read a secret, send — each call passes its own check, and the coexistence is the leak. Per-call inspection has no vocabulary for it, because nothing is tracking what the session has accumulated.
They answer different things and they compose: what an agent may reach at all, what a single run may do, and how several agents share one run without doing anything twice.
Reads your .claude settings and MCP config and determines whether the permissions you already granted allow a path from untrusted input to credential or source egress. An opt-in runtime guard enforces the same model while the agent runs.
A workflow engine for AI agents. It admits a workflow only if every reachable path satisfies the rules you wrote down, then runs it durably and hands the agent one work order at a time. It holds no credentials and calls no tool itself.
Read the engine and the OpenWorker results → POLYCREW · SHARE THE RUNThe multi-participant layer over polyflow. A crew shares one broker, each agent claims an order nobody assigned, only the holder may report, and a session that dies mid-order loses its claim to the next one. The journal records who did what. No supervisor, no channel between agents.
Read the two-session run →Prompt injection, goal hijacking and tool misuse name ways to reach a bad state. The state itself is the thing worth checking — and that is what a red line is: a situation declared off-limits in advance, not a phrase to watch for in a message. That reframing is what the two engines below are built on. Neither is distributed; both are described.
Stop asking the agent whether it stayed in bounds. Check that the bounds hold, on every path, before it runs.
Takes GitLost — an agent leaking a private repo where every individual step was allowed — and treats it as a reachable-bad-state bug rather than a prompt problem.
Read the case → POLYMAN · ENGINE · NOT DISTRIBUTEDThe runtime half: a gate between the agent and its tools that tracks what the session has touched and refuses the call that would close the trifecta.
Read the gate →Three essays working the same argument through different sectors.
The same substrate verifies the stateful code an agent writes — that is the SAM v2 gate, seven tools around one deterministic check. If you want the guardrail work applied to your own stack, that is what the advisory engagements are for.