PILLAR · SECURE
Set boundaries before agents act
Stop supported model, agent, MCP, and local tool actions before execution.
Pre-dispatch
On documented enforcing routes
19 types
PII detected and redacted
15+
Documented integration surfaces
Zero executions
For denied tools on tested routes
Where obsvr sits
Your stack has a gap
Your App
Your application
Generates model calls and agent runs, then routes intent to supported providers, frameworks, and tools.
Governance Layer
obsvr, the enforcement layer
Owns documented provider and tool boundaries, runs policy before dispatch, and labels tracing-only routes separately instead of reporting a block that did not happen.
Provider
LLM provider
Processes prompts and returns completions without owning policy enforcement or the audit trail.
The missing layer
Where governance belongs in your agent stack
Policy enforcement
Rules that run, not rules that sit in a doc
Pre and post-call policy
Rules run before dispatch and after responses on supported provider wrappers, while tracing-only routes remain clearly labeled.
Strict execution receipts
For selected unary direct-provider calls, opt into a signed decision receipt, positive admission, and durable local commit before the provider is contacted.
Shadow mode
Run a strict rule against live traffic and see what it would have done without blocking, then promote it once the impact is what you expect.
Org policy packs
Versioned, content-addressed rule packs ship org-wide, and org mandates cannot be overridden locally.
A floor that cannot be turned off
Policy-floor rules keep enforcing even when local code tries to disable or override them.
Signed policy history
Every policy change is diffed, attributed, and hashed into the daily Merkle root, and the SDK verifies each Ed25519-signed policy against a pinned key.
OPA / Rego export
Export the policy set as a generated .rego and data.json bundle, rules-hash stamped and parity-verified against OPA itself.
Approvals
Turn a block into a recorded, time-boxed approval with optional separation of duties.
Agent runs
A multi-step agent, as governable as one call
Tool allowlists and denylists
Define exactly which tools an agent may invoke per run; out-of-scope tools are blocked before they execute.
Step limits and auto-stop
Cap tool calls per run and block or escalate at the limit, with repeated identical actions raising a high-severity incident.
Cost governance and kill switch
Token budgets are enforced at call time, and pausing a project blocks every governed call within seconds.
Framework-native, output-aware
Supported agent runners and governed tools apply tool policy, run limits, and output controls at their documented boundaries, with denied-tool tests asserting zero executions.
Governed steps, tools, and decisions in one run view.
Calls that violate policy are blocked before execution, and every allowed and blocked call is signed into the audit chain.
- Tool-level allow and deny enforced before execution
- Step limit triggers automatic escalation
- Output topic denylist applied on run completion
- Full trace included in the SOC 2 evidence export
MCP tools
Govern the protocol, not just the prompt
- Tool-poisoning defense at tools/list, before any call
- Description drift detection across discoveries
- Client-side, no proxy in the data path
Data controls
Sensitive data stays inside your boundary
When things break
Detector failures resolve at a declared boundary
A crashing detector never reaches your app
Every detector resolves failures at a declared SDK boundary instead of surfacing an unhandled error in your app.
Fail open or fail closed
Fail-open by default with local buffering, or set failMode: closed to block whenever a verdict cannot be rendered.
Local cache, graceful degradation
A local policy cache keeps rules enforced through outages, with timeouts, retries, and events that buffer and flush on recovery.