Security

AgentGuard runs in process. Governed provider traffic goes directly from your application to the provider you selected, without an AgentGuard inference proxy. Policies and signing private keys stay in the SDK runtime. The plugin’s hooks read host metadata locally and never open a socket.

flowchart LR
  A[Your agent runtime] -->|prompt, provider key| P[Your provider]
  A -.->|policy decision, in process| G[AgentGuard SDK or plugin]
  G -->|signed, content-free rows| L[(Local ledger you hold)]
  G -.->|license check only, optional| C[agentguard.run]
  P -->|completion| A

Receipt verification

When signing keys and a decision-log store are configured, signed entries can be checked with Ed25519 signature verification and hash-chain validation, offline, with the public key only.

Hosted endpoints

Account, license, seat heartbeat and optional telemetry workflows use hosted endpoints. AI calls and policy enforcement remain customer to provider.

Decision rows record tool names, input hashes, byte counts, actor identifiers, configured cost and the policy result. They never retain prompts, tool input content, output text or provider credentials. Tool names and identifiers can still be sensitive metadata: protect the policy, the private signing key and the records the same way you protect the repository.

For the product boundary in legal terms, see the legal FAQ.