Governing Agent Transactions, A series on governing autonomous agents inside the systems that run the business. In the first post in this series, I described several agents being piloted right now — an invoice agent, a claims agent, a credit agent, a sales agent, an expense agent, a vendor payment agent, a contract agent. Different systems of record, different domains. Same underlying shape: an action with a real, binding consequence, and a condition that defines what the agent is allowed to do and not allowed to do. Let’s walk through a real example of an AP agent.
Slack just made your coding agents more powerful. That is also the problem. Four major AI coding agents now live natively inside your Slack workspace: Claude Code from Anthropic, Codex from OpenAI, Cursor, and GitHub Copilot. @mention any of them in a channel, and they get to work. They read your conversation history, your canvases, your connected developer tools. Then they push commits, investigate bugs, open pull requests, and trigger deployments. Slack calls this “multiplayer coding.” Agents with full context working alongside your team, in the same channels where you argued about architecture, wrote the postmortem, and decided to delay the release. The productivity case is real. The authorization question has not been answered.
Most AI guardrails were built to screen text. They were not built to govern actions. That distinction did not matter much when AI systems generated reports and drafted emails. It matters now. AI agents are calling APIs, writing to databases, triggering payment approvals, and modifying production systems. The guardrail question has shifted from “is this output safe?” to “is this action authorized?” and the tools enterprises deployed for the first question cannot answer the second. This post explains what AI guardrails are, how the two dominant approaches work, where each one fails, and what agentic AI actually requires.
Summary MCP introduces unique risks because agents dynamically call tools instead of following static API paths. Traditional perimeter defenses like WAFs cannot inspect the intent behind agentic tool execution. LangGuard provides the definitive runtime governance layer for enterprise-grade MCP security. Enterprises must transition from static security policies to deterministic, real-time enforcement of agent actions.
Can Your Agents Commit? Governing Agent Transactions, Part 1 of a series on governing autonomous agents inside the systems that run the business. I’ve been thinking a lot about that question — about “Agent Transactions.”
