ENGINEERING BLOG
Engineering notes on policy, evidence, and production agents.
A guard that throws is neither fail-open nor fail-closed. It is the absence of a decision. Working through that question properly took an architecture decision record, a registry, and a rule about failure paths we did not have before.
Every control that sits in one place has the same weakness: the traffic that never went through it. Proving coverage is a different problem from enforcing policy, and most stacks only solve the first one.
Where you put the control layer decides its latency budget, and the gap between in-process and network gateway is about three orders of magnitude. That difference changes which calls you can afford to govern.
The best injection detectors are machine-learned models scoring above 97% F1. We use deterministic rules that score lower. That is a deliberate trade, and the reason is what an auditor can do with the answer.
The standard objection to HITL is that it doesn't scale. That's true if HITL is your end state. It isn't.
MCP servers can lie about what their tools do. An agent reading a malicious tool description can be manipulated before it calls a single tool.
Every audit event is signed on the client, chained to the one before it, and countersigned by the server. Here's the exact mechanism, and why a client-side signature alone isn't enough.
Most MCP governance approaches wrap individual tools one at a time. obsvr governs the MCP Client itself with a non-mutating proxy, so every server, transport, and tool gets covered by the same interception point - no monkey-patching.
Traditional IAM was built for humans. AI agents break every assumption it makes. Here's what a SOC 2 auditor actually needs to see when non-human entities are executing code.
Tool-level interception catches the execution. LLM-level interception catches the intent. For governance, intent is what matters.
Three modes, three different compliance postures. Which one your system needs depends on your data classification, your regulatory obligations, and your tolerance for friction.
Updated July 2026: Annex III high-risk rules were deferred to 2 December 2027 and product-embedded high-risk rules to 2 August 2028. This is the implementation-oriented version.
Prompt injection stopped being theoretical when agents started acting on content they fetch from the world. Four structural shapes the attack takes, and why the durable defense is not at the model layer.
LangChain handles orchestration. OpenAI handles inference. Nobody handles what happens between them. That gap has a name now.
When you give an AI agent tool access, you're not just adding capability. You're opening an attack surface that most teams aren't thinking about.
An agent with tool access is software that decides what to do at runtime, from natural language, with production credentials. Almost nothing in the standard stack is built to constrain that. This is the layer we thought was missing.