AI Agent Governance
Deciding, before a tool call runs, whether the agent may make it, and keeping the record. Intercis does not run the human approval step. The longer guide to AI agent governance is on the blog.
- Measured: 40 of 47 payloads, our own corpus
- Not measured: latency
- Observed, not governed: hosted MCP tool calls
What it is
Four pillars hold it up: interception before execution, so the call is read before the runtime can act on it; a policy engine that says which actions are permitted in which contexts; an audit trail the agent process cannot reach; and human escalation, so a person rules on the calls that are neither clearly allowed nor clearly denied. This is the definition the rest of this site uses. Intercis has the first three and not the fourth.
Chatbot safety filters text output. This is about tools. When an agent holds filesystems, databases, cloud credentials or APIs, every tool it holds is one more thing somebody has to write a rule for.
How it works
Governance operates on an allow/deny/observe model. When an agent attempts an action, the governance system evaluates it against policy rules. Allowed actions pass through immediately. Denied actions are blocked before execution — the tool call is removed from the response before the agent runtime can act on it. Observed actions are logged for review without blocking. (A human-review escalation verdict is a governance concept Intercis does not run as a live control today.)
Decisions — allow, deny, observe — are logged, on a best-effort basis, to an append-only trail the agent process cannot modify once a row is written. Records are hash-chained, which makes after-the-fact tampering detectable unless whoever did it can also recompute the rest of the chain.
Related terms
What Intercis does not govern
Intercis judges the tool calls that cross the Anthropic and OpenAI API wire. When a hosted MCP server runs a tool for the model, that call has already run by the time the response reaches the proxy, so it is observed, not governed: it writes one observe row and is never judged or blocked. Being in path is also a configuration setting: a process that can change its own base URL can route around the proxy unless network egress control forces the traffic through it.