Set deterministic spend caps, rolling velocity rules, and caller identity checks on every tool call before an AI agent can move money, issue concessions, or modify production records.
Chat, voice, and workflow agents process external user inputs and propose an outbound API action (refunds, payouts, rate quotes, or POs).
Verifies signed caller identity out-of-band, reserves atomic sliding-window quota, and enforces hard parameter ceilings before execution.
Internal services verify inline Ed25519 tokens; third-party SaaS endpoints (Stripe, Shopify, TMS, ERP) execute with a hash-chained audit receipt.
System prompts are not a security boundary. If an agent's API credential has permission to issue a $20 credit or approve a routine purchase order, prompt manipulation can trick that same credential into approving a $5,000 payout. LockedAgents intercepts every proposed tool call outside the LLM context window.
SaaS agent builder, LangGraph, or MCP client emits proposed action.
Validates host-signed OIDC/JWT tokens, OAuth 2.0 On-Behalf-Of (act) claims, and external counterparty registries outside the prompt context.
Maintains idempotent sliding-window counters across stateless turns, fresh sessions, and parallel tool calls to stop split-transaction farming and iterative price probing.
Evaluates JSON payload fields against versioned policy-as-code conditioned on live account tier, benchmark feeds, and field-level read/write locks.
Signs a canonical SHA-256 receipt (X-LockedAgents-Signature) binding verified principal, policy version, and executed payload for SOX, SOC 2, and dispute proof.
Locks sliding-window spend, injects vaulted upstream credential (or signs capability token), and executes request.
Blocks execution without crashing the agent loop, returning a structured constraint so the bot counter-offers cleanly.
Holds tool_call_id state, triggers customer OTP or Slack/Teams manager approval, and resumes on sign-off.
if statement in your tool wrapper or use an API gateway?
Single-request parameter checks work for static web forms. They break down when autonomous agents loop across turns, parallel workers, and shared service credentials.
| Production Failure Mode | Local Wrapper (if amount > 50) / Stateless Gateway |
LockedAgents Inline PEP |
|---|---|---|
| Split-Transactions & Parallel Races | Inspects one call in one worker process. Bypassed by ten $49 calls across fresh sessions or parallel tool-call emissions in a single turn. | Executes atomic, idempotent sliding-window reservations across sessions, channels, payment fingerprints, and counterparty IDs. |
| Conversation-Safe Agent Recovery | Returning HTTP 403 or raising Python exceptions triggers blind retry middleware, hallucinated answers, or frozen customer chats. | Wraps STEER constraints in structured tool feedback so the bot smoothly offers a return label, store credit, or compliant counter-rate. |
| Confused-Deputy & Shared Keys | Downstream APIs see only the agent's standing root key. Prompt injection can trick the agent into modifying another customer's or vendor's record. | Matches host-signed caller assertions against target resource owners out-of-band and injects vaulted credentials only on ALLOW. |
| Async Human Step-Up (HITL) | Holding an HTTP worker open for a 20-minute manager approval times out connections and breaks the LLM tool_call_id sequence. |
Checkpoints call state, triggers customer OTP or Slack/Teams approval diffs, and resumes the exact tool_call_id on callback. |
| Central Audit & Safe Rollouts | Business caps are hardcoded across scattered repos requiring engineering deploys to tune, with no non-repudiable receipt for audits or disputes. | Replays draft rules in shadow mode against live traffic and signs hash-chained Ed25519 receipts for SOX, SOC 2, and chargeback defense. |
/v1/evaluate inside your VPC
Deploy as a stateless Docker/Envoy sidecar inside your own cloud or through our regional proxy—upstream secrets stay under your control in both modes.
Point your Custom Action or Webhook Node URL to your LockedAgents sidecar or proxy endpoint. On ALLOW, the sidecar injects your vaulted API key and forwards the call. On STEER, it returns HTTP 200 with a structured constraint so the agent never crashes on 4xx retry middleware.
{
"executed": false,
"verdict": "STEER",
"instruction_for_agent": "Amount ($240) exceeds $50 returnless cap for this tier. Offer prepaid return label or $35 instant credit."
}
For custom orchestrators and internal MCP servers, call POST /v1/evaluate before executing privileged logic. Raw database connections stay local, and internal microservices can verify X-LockedAgents-Signature inline.
# Inside your Python / TypeScript tool execution wrapper: decision = requests.post("http://lockedagents-pep:8443/v1/evaluate", json={ "session_id": session_id, "principal_assertion": signed_session_jwt, "tool_name": "payments.issue_payout", "tool_args": tool_args, }).json() if decision["verdict"] != "ALLOW": return decision["steering_message"] # Guides LLM next turn return execute_mutation(**tool_args, sig=decision["signature"])
Deploy in observe-only shadow mode to measure every off-policy concession, split-transaction probe, and unverified caller across live traffic—then promote tested policies via Git with dual-control sign-off.
Replay 30 days of past tool-call logs against candidate spend caps to verify exact margin saved versus human escalation volume.
Version every threshold in Git and require dual approval from Finance/Ops and Security before rule changes take effect in production.
Inline security can never become a single point of failure on Black Friday or peak dispatch hours. Define deterministic fallback rules per endpoint and keep root credentials vaulted inside your own cloud.
Enforce strict fail-closed halts on high-dollar payouts and bank edits while allowing cached local fallback with PagerDuty alerts on low-risk tools.
Run enforcement adjacent to your orchestrator pods with native AWS Secrets Manager, GCP Secret Manager, and HashiCorp Vault bindings.
LockedAgents evaluates payloads in volatile memory and never stores raw payment PANs, customer PII, or proprietary contract documents—eliminating data-lake compliance scope.
Persist only canonical SHA-256 payload digests, principal IDs, policy SHAs, and Ed25519 signatures for SOX, SOC 2, and dispute evidence.
Stream structured OCSF authorization telemetry directly to Splunk, Datadog, Panther, or Snowflake for security and finance teams.
Let support agents resolve Tier-1 tickets autonomously without opening a backdoor to refund rings and serial promo stackers. Cap returnless refunds by verified net LTV, block rolling 30/60/90-day appeasement farming across fresh chats and linked payment fingerprints, verify carrier drop-off weight scans before releasing funds, and require SMS OTP before email or shipping-address edits.
Gate autonomous carrier sales and inbox agents before an overpriced rate con or fraudulent carrier hits your TMS. Correlate repeat callers across aliases to shut down multi-call max-buy fishing, enforce stepped escalation curves against live DAT lane benchmarks, hard-cap detention, layover, and TONU accessorials, and block send_rate_con until Highway identity, insurance, and ELD/VIN checks pass.
Accept orders and subscription modifications initiated by external AI shopping and travel assistants without eating friendly-fraud chargebacks (Visa 10.4 / Mastercard 4837). Verify pre-authorized spend ceilings and SKU refundability rules prior to capture, and bind the shopper's verified session identity, device fingerprint, and mandate digest directly to your processor webhook for Visa Compelling Evidence 3.0 defense.
Stop autonomous sourcing agents from bypassing approval tiers via split requisitions or leaking reserve budgets during supplier negotiations. Track cumulative 24-hour and 30-day spend across cost centers, lock contracted SKU price tolerances and Net-45/60 payment terms at the ERP boundary, and require human co-signing before onboarding unvetted vendors or modifying remittance routing.
Mirror live tool calls in passive shadow mode or run an offline replay on 7 days of historical logs. Zero added latency, zero blocked customers, and no raw payment PANs required.
Your scoping brief is formatted below. Click Open in Email App, or copy the brief and paste it directly into Gmail / Outlook to contact@lockedagents.com.