Deterministic Runtime AI Governance

Your AI agents are taking actions.
Do you know which ones are authorized?

LangGuard's deterministic runtime AI governance control plane maps and classifies the complete action surface of every AI agent in your business workflows, detects Segregation of Duties (SoD) violations in real time, and enforces human authority when a high-risk action is attempted. Built for AI builders, internal controls, IT and security deploying agents in production.

Test Your Agent Action Surface Today See a Live SoD Detection Demo

Claude — Cowork LangGuard

LangGuard is aligned with

Databricks
Built-On Partner

Why it matters now

Agents ignore your enterprise controls.

IT service management, SOX controls, and SoD frameworks were all built for humans making decisions. AI agents are taking actions: calling APIs, writing to databases, triggering approvals. Your existing governance infrastructure was not designed to see them, let alone stop them.

Your Accounts Payable agent just approved its own invoice.

No SoD rule stopped it. No human reviewed it. The auditor finds it three months later. The question they ask: "Who authorized that action?" Nobody has an answer.

Your Coding agent deleted a production database despite instructions not to.

AI autonomy unchecked for excessive agency. Not a "rogue" action; it just acted on incorrect assumptions. The question they ask: "What excessive actions is the agent capable of taking?" Nobody has an answer.

Your multi-agent workflow needs human authority for legal and regulatory requirements. IT and security can't tell which actions were authorized.

ITSM logs show "workflow completed." IAM logs show "user accessed system." Neither records which agent took which action, in which order, against which policy, with whose authority. Audit committees are beginning to ask. Nobody has a ready answer.

OWASP LLM06:2025 · AIUC-1 D003

The risk has a name. So does the control.

The risk

Excessive Agency

OWASP catalogues excessive agency as LLM06:2025: an agent given the ability to call tools can take damaging actions on the back of output that is unexpected, ambiguous, or deliberately manipulated. It traces the risk to three causes: excessive functionality, excessive permissions, and excessive autonomy. The mitigations it names are to limit an agent to the minimum tools it needs, scope every permission to least privilege, and put a human in front of high impact actions.

Read LLM06:2025 on OWASP

The control

Restrict unsafe tool calls

AIUC-1 turns that guidance into something an auditor can test. Control D003 is mandatory and preventative, requiring safeguards that prevent tool calls in AI systems from executing unauthorized actions, accessing restricted information, or making decisions beyond their intended scope. The evidence it expects is specific: per agent tool authorization and parameter validation, rate limits, logging of every tool call, and human approval workflows for high risk operations.

Read D003 on AIUC-1

Both point at the same place: the moment a tool call is about to execute. LangGuard authorizes that call deterministically before it runs, against the action surface mapped for that agent at design time. Anything crossing a Segregation of Duties boundary or a policy threshold routes to a named approver, and every decision lands in the audit ledger as evidence you can hand to a reviewer. See how MCP Context Authorization enforces it.

AI guardrails

What are AI guardrails?

AI guardrails are the constraints that decide what an AI system is permitted to do while it is running. For an agent — a system that calls tools and changes records — the guardrail that matters sits in the path of the action: a check that runs after the model has decided what to do, before the tool call executes, and that can stop it. Guardrails that only shape what a model says leave every action it takes ungoverned.

How are AI guardrails different from content filtering?

Content filtering is probabilistic. A classifier scores text for toxicity, prompt injection or leaked PII and acts on a confidence threshold, so the same input can be judged differently twice and neither result can be explained to an auditor. A guardrail on an action is a rule: this agent may read invoices and may not approve them. LangGuard evaluates that rule deterministically on every tool call, so the same action against the same policy returns the same decision today and in next year's audit. Most enterprises need both: filtering for what the model says, deterministic guardrails for what the agent does.

What is deterministic AI governance?

Governance where the decision to permit an action is made by evaluating rules rather than by scoring a likelihood. Nothing in the enforcement path is itself a model. Segregation of Duties is the clearest case: whether the agent that raised a purchase order is the one now approving it is a fact you look up, not a pattern you detect. Deterministic decisions are reproducible and explainable, which is what makes them usable as audit evidence rather than as a signal someone still has to investigate.

How do you implement human-in-the-loop AI governance?

By binding the approval to the action instead of to an alert queue. In LangGuard the mechanism is named-approver escalation and it has three parts. What triggers it: a policy scope on the action — crossing a Segregation of Duties boundary, exceeding a value or blast-radius threshold, or touching a system classified as regulated. Where it routes: to the named approver on that policy, the person accountable for that scope, not to a shared channel. How it is recorded: the action is held until that person allows or denies it, and the decision, the approver, the policy that fired and the timestamp are written to the audit ledger together. An alert that arrives after the invoice is paid is not human-in-the-loop.

What does least privilege mean for an AI agent?

For a person, least privilege means holding only the permissions the job needs. For an agent it has to be narrower, because an agent inherits the full reach of every tool it is connected to whether or not its task requires it. An agent authorized to read invoices cannot approve them. LangGuard SCOPE-MCP sets that boundary at design time by mapping the agent's complete action surface — every tool, every operation, every system of record it can reach — and classifying each operation against SoD and regulatory rules. Arbiter enforces it at runtime: an operation outside the agent's scope is not a violation to review later, it is a call that does not execute.

Longer answers on each of these: AI guardrails, deterministic governance, human-in-the-loop approvals, and least-privilege agent permissions.

What LangGuard provides

Two capabilities no existing tool provides.

Design Time

Action Surface Validation

Before you can govern what your agents do, you need to know what they're capable of doing. LangGuard SCOPE-MCP maps and classifies the complete action surface of the multi-agent workflow: every tool connected, every operation exposed, every system of record reachable. Pre-classified against SoD rules for a given tool, and regulatory requirements including SOX, GDPR, and ISO 42001. Know your exposure before it becomes your incident.

LangGuard SCOPE-MCP Browse MCP Servers

Runtime

Action Authorization Enforcement

Visibility alone is not governance. LangGuard Arbiter deterministically evaluates every agent action before it executes. Safe actions clear automatically with no latency overhead. Actions that cross a SoD boundary, exceed an authorization threshold, or trigger a compliance rule are routed to named human approvers automatically before they complete, not flagged or ticketed after the fact. The action authorization is the governance. The audit trail is automatic.

LangGuard Platform

Who LangGuard is for

Deterministic governance that works for every stakeholder.

Line of Business / AI Builders

AI engineers · Platform and ML leads · LOB automation owners

Understand exactly what your agents are capable of doing, before it does it. LangGuard SCOPE-MCP classifies and maps the action surface for your agents, proactively prevents excessive agency at runtime, and delivers access reviews for IT, security, and compliance requirements.

Internal Audit / Chief Risk Officer

CRO · Head of Internal Audit · Audit committee · External auditors

When your auditor asks what authorized the agent to take that action, LangGuard gives you the answer. An immutable, replay-ready chain of custody for every agent action, every policy check, every human approval. Audit-ready without manual reconstruction. Quarterly Audit Committee reports generated automatically.

IT & Operations Teams

CIO · IT operations · Service management · Enterprise architecture

Move from reactive troubleshooting to proactive AI controls. LangGuard gives IT the authoritative registry of every AI agent in production: who owns it, what tools it's connected to, what it's done. When an incident occurs, the full action trace is already there. No reconstruction. No guesswork.

Security Risk & Compliance

CISO · GRC and compliance leads · Security operations

Don't just alert-fix. Orchestrate incident response and remediation actions using your security platforms. Complete audit trail with policy-check records for every agent action across your entire production environment.

Solution Features

Everything you need to accelerate AI agents into production, confidently.

MCP Context Authorization

Control how your enterprise alpha (proprietary data, workflows, and decision authority) moves through agents, models, and runtimes. Trusted-path and purpose-boundary policies, deterministically enforced by LangGuard Arbiter.

Trusted Path Policies: where context may travel
Purpose Boundary Policies: why context may be used
ALLOW · BLOCK · ESCALATE enforcement (Arbiter)

Explore MCP Context Authorization

MCP Context Authorization: enterprise alpha flows governed with trusted-path and purpose-boundary policies

AI Cost Management

Meter and enforce AI token spend at the workflow level. Set a flexible rolling budget and hard-block the one workflow that runs away, before it ever shows up on the invoice.

Per-Workflow Budgets
Real-Time Budget Enforcement
Cost & Token Visibility

Explore AI Cost Management

AI Cost Management: per-workflow token budgets enforced in real time

Runtime AI Agent Monitoring

Gain deep visibility into agent behavior with comprehensive tracing, and detect policy violations and anomalies as they happen. With LangGuard Arbiter, move beyond detection to deterministic runtime enforcement, authorizing or blocking every agent action before it executes.

Deep Tracing
Anomaly Detection
Performance Metrics
Runtime Action Enforcement (Arbiter)

Policies and Actions

Go beyond observation. LangGuard Arbiter enforces your policies in real time, deterministically authorizing every agent action before it executes, and automates remediation to maintain security and compliance standards.

Automated Remediation
ROI Tracking
Custom Policies
Deterministic Policy Enforcement (Arbiter)

Live AI Agents and Tools Registry

Automatically discover and catalog all AI agents and tools in your environment. Build a dynamic knowledge graph integrated with your CMDB.

Real-time discovery using systems of record, network traffic, and telemetry monitoring
CMDB Integration
Dependency Mapping

Forward-Deployed Engineering

Outcome-based engagements that move a priority agent into trusted production in four to six weeks, leaving behind a reusable governance foundation you own.

Fixed scope, tied to production milestones
Trusted production in 4–6 weeks
You keep the agents, policies, and implementation
Compliance-ready: SOC 2, PCI, HIPAA, ISO…

Explore Forward-Deployed Engineering

Forward-Deployed Engineering: a six-week milestone plan ending in governed production

Compliance

Regulatory alignment

Where LangGuard's controls map to the frameworks enterprises are audited against. This is a control mapping, not a certification claim: the obligations belong to you as the deployer, and these are the capabilities that produce the evidence for them.

LangGuard capabilities mapped to regulatory and control frameworks
Framework	Obligation	LangGuard capability
EU AI Act — Article 14, Human oversight	High-risk systems must be designed so a person can oversee operation and intervene or interrupt it.	Arbiter holds any action that crosses a policy threshold and routes it to a named approver before it executes, rather than raising an alert after.
EU AI Act — Article 12, Record-keeping	Automatic recording of events over the lifetime of the system.	Every decision — allow, block, escalate — is written to a tamper-evident action ledger with the agent identity, the policy that fired and the approver.
EU AI Act — Article 26, Deployer obligations	Deployers must assign human oversight to competent, authorized people and retain the generated logs.	Approvers are named per policy scope, so each approval records who held the authority; the ledger is the retained log.
NIST AI RMF — GOVERN, MAP	Maintain an inventory of AI systems and document their risks in the context of use.	SCOPE-MCP maps and compliance-classifies each agent's complete action surface at design time, backed by a live registry of agents and the tools they reach.
NIST AI RMF — MEASURE, MANAGE	Monitor identified risks on an ongoing basis and act on them.	Runtime tracing and anomaly detection for observed behavior, plus deterministic pre-execution enforcement for the risks you have already decided are unacceptable.
ISO/IEC 42001 — AI management system	Documented controls, objectives and operational evidence across the AI lifecycle.	Design-time classification and runtime decision records give per-agent evidence for both halves of the lifecycle, generated as a by-product of enforcement.
SOX — Segregation of Duties	Whoever initiates a transaction must not be the one who approves it.	SoD boundaries are evaluated deterministically on every agent action; a crossing is blocked or escalated to a named approver, never reconciled after the fact.
SOC 2 — CC6 access, CC7 monitoring	Restrict access to what is authorized, and monitor system operation for deviations.	Least-privilege scoping per agent enforced at the tool call, and a complete record of every authorization decision including the denials.

For the AI-specific standards — OWASP LLM06:2025 Excessive Agency and AIUC-1 D003 — see the control mapping above. For the full obligation-by-obligation breakdown, including where the deployer's own duty begins, see compliance-driven AI governance.

Find out what your agents can do —
before your auditor does.

LangGuard maps your complete agent action surface in minutes. Free for the first five managed agents. All Scopes (Finance, IT, Procurement, HR) included from day one. No policy writing required.

Test Your Agent Action Surface Free See a Live SoD Detection Demo

No credit card required · First 5 agents free · All LOB Scopes included · Enterprise ready

Your AI agents are taking actions. Do you know which ones are authorized?