Wrap every tool call. Default-deny. Hold the wire. Kill the session.
An insurance layer for agent tools: allowlists, spend/step/time caps, human approvals, anomaly hooks, and kill switches — enforced before the tool runs, not after the model apologizes.
Who it's for
Teams shipping an agent harness who need policy outside the prompt — especially anything that can pay, shell, or email.
- Harness authors who can wrap tools with wrapTool / invoke
- Platform groups who want HTTP authorize + report for a remote runtime
- Ops and finance who must approve payments.wire and deny shell.exec
The problem
The model decided to shell.exec. Your system prompt said please don’t. Spend lived in a comment. The wire went out because nobody had a hold state. Kill switch was a Slack message.
What breaks without it
- Allowlists in prompts are suggestions.
- There is no pending_approval — high-risk calls just run.
- Failed tools still increment steps or spend, so budgets lie.
How it works
Concrete path through the private beta — not a capability cloud.
Upsert a tenant policy
Default-deny or default-allow. Deny list always wins. Names accept globs (payments.*). Caps: maxSpendUsd, maxSteps, maxDurationMs, maxCostPerCallUsd.
Wrap tools in-process
createControlPlane().wrapTool({ name, estimateCost, execute }). invoke is atomic: decide, optional execute, usage. Failed tool functions do not consume steps or spend.
Hold, approve, resume
requireApproval patterns and/or approvalRiskAtOrAbove. Status pending_approval parks the turn. Ops approve or reject; resume continues. The example harness holds payments.wire.
Remote runtimes use HTTP
authorize then report after the host actually runs the tool. Kill switches are tenant-wide or per-session. Audit events stay tenant-scoped.
Proof points
From the working repo and demo scripts. Design partners welcome. No fabricated case studies.
- Private-beta TypeScript SDK (@letslego/agent-control-plane) plus a thin HTTP API on :8787.
- Shipped example: allowlisted search, deny-listed shell.exec, held wire that resumes after approval, then a spend-cap tripwire.
- Decision order is documented and tested: policy → kill switch → session → caps → deny/allow → anomaly → approval → allow.
- Anomaly hooks: call velocity, spend velocity, or custom. Actions: flag, require_approval, kill.
- In-memory store only (single process) — stated as such. MemoryStore is the persistence boundary. Design partners, not fake bank logos.
Join waitlist / book a 15-min pilot
Tell us you want Agent Control Plane. We'll reply with a demo path, not a deck.
FAQ
How is this different from the fleet runtime?
Fleet runtime is the multi-tenant executor (tenants, runs, ledger, dashboard). Control plane is the policy SDK you wrap around any harness — including one that is not the fleet. They compose; they are not the same product.
What if the tool throws?
Failed tool functions do not consume steps or spend. You are billed for work that happened, not for attempts that died.
Can I default-allow and still block a few tools?
Yes. Deny list always wins. Default-deny with an allow list is the safer private-beta posture, and the one the example uses.
Does HTTP invoke the tool for me?
No. HTTP is two-phase so a remote runtime can run the tool itself: authorize, then report. In-process invoke is the atomic path.
Is there persistence?
Not yet. Private beta is in-memory, one process. We will not advertise a control-plane SaaS until that boundary has a real store. The API shape is the part to design-partner against.