Agent Action Guard

Definition

Agent Action Guard evaluates AI agent tool calls against configurable policies. It returns allow, review, or block decisions before actions execute in your environment.

Use cases

• Gate database write operations from autonomous agents
• Review file system and shell commands before execution
• Enforce allowlists on third-party API calls from agents
• Audit and block high-risk agent actions in production workflows

How it works

1. Submit the tool name, action, and arguments the agent intends to execute
2. Policy engine matches against default and custom rules
3. Each evaluation returns a guard verdict with findings
4. Integrate synchronously in your agent loop before tool execution

Request example

curl -X POST "https://www.identicapi.com/api/v1/security/agent-action" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "tool_name": "shell",
  "action": "execute",
  "arguments": {
    "command": "rm -rf /"
  },
  "context": "User asked to clean up temporary files"
}'

{
  "tool_name": "shell",
  "action": "execute",
  "arguments": {
    "command": "rm -rf /"
  },
  "context": "User asked to clean up temporary files"
}

Response example

{
  "request_id": "req_01HXYZ",
  "api": "agent-action-guard",
  "verdict": "block",
  "risk": "critical",
  "findings": [
    {
      "category": "destructive_command",
      "reason": "Destructive shell command detected"
    }
  ],
  "reasons": [
    "Action blocked by policy: destructive commands not allowed"
  ],
  "usage_units": 1,
  "processing_time_ms": 5,
  "detector_version": "1.0.0"
}

Verdict semantics

Limitations

• Policy coverage depends on configured rules — custom policies required for domain-specific tools
• Evaluates intent metadata, not runtime behavior after execution
• Agent Action Guard policies require Developer plan or above