Agent Security

Agents plan tool calls. Agent Security sits between the runtime and integrations (email, tickets, APIs). Each call hits the policy engine (decide API) before side effects run: allow, deny, or pending. Allow executes the tool. Deny blocks it. Pending goes to a human-in-the-loop approval queue. Every decision is recorded on an append-only audit trail (workspace events, export later).