AgentIssue is safety infrastructure for autonomous AI agents. It evaluates tool and action requests before execution and returns a decision to allow, block, or require human approval.

How does AgentIssue fit into an agent application?

The application checks an action with AgentIssue before executing it. Policies evaluate the agent identity, permissions, tool, arguments, environment, and risk. The application uses the returned decision to control execution.

Who is AgentIssue for?

AgentIssue is for teams building agents that interact with production APIs, infrastructure, payments, or customer data.

Is AgentIssue publicly available?

AgentIssue is in private alpha. The landing page contains illustrative policy and integration examples. Request early access to discuss availability and integration with your team; submitting a request does not create an account or grant access automatically.

What happens when I request early access?

Your email, company or project, and description are saved for the AgentIssue team to review. The team may contact you using the email you provide. No account, API key, or automatic confirmation email is created by this form.

Stop AI agents before they do something they shouldn’t.

AgentIssue evaluates agent actions before execution, applies your policies, and automatically allows, blocks, or escalates risky operations.

Request early access See how it works

Tool callEdit anything. The decision updates as you type.

Agent

Environment

Tool

Arguments

Decisionprod-destructive-actions

AgentAgentIssueTool

BLOCK

Destructive production actions require explicit human approval.

Risk: critical
Matched policy: prod-destructive-actions
Approvers: engineering_admin
Execution: does not run

AI agents are becoming more capable. Their permissions are becoming more dangerous.

The same tool access that makes an agent useful makes one bad decision expensive. Most agents reach those tools with nothing in between.

Agents increasingly hold credentials for

production databases
cloud infrastructure
CRM systems
payment APIs
internal tools
customer data

Without AgentIssue

Nothing checks the request. Whatever the model decides, happens.

Agent

Tool

Action executed

With AgentIssue

Every request is evaluated against policy first. Safe actions pass. Risky ones stop or wait for a person.

Agent

AgentIssue policy layer

Tool

Every action gets evaluated before execution.

One call sits between the agent deciding to act and the action running. Four things happen inside it.

Intercept
AgentIssue receives the tool or action request before anything runs.
stripe.refund_customer()
Evaluate
Identity, permissions, policy, risk, and the action arguments are evaluated together.
identity, tool, arguments, environment, policy, risk
Decide
A decision comes back that the calling code can act on immediately.
ALLOWBLOCKREQUIRE_APPROVAL
Audit
Every decision is stored as an explainable execution trace you can query later.
trace_01j9rk4m8e

Policies your agents cannot ignore.

Policies are plain, versioned configuration. They live outside the agent, so a cleverly worded prompt cannot talk its way around them.

policies/production_database_protection.yaml

policy: production_database_protection

when:
  environment: production
  action:
    - delete
    - truncate
    - drop

decision: require_approval

approvers:
  - engineering_admin

Decision preview

Operation: DROP TABLE users
Environment: production
Matched: production_database_protection
Risk: critical
Result: REQUIRE_APPROVAL

Execution pauses. An engineering admin gets the request with full context. Nothing runs until someone says yes.

The firewall for AI agents.

Traditional firewalls protect networks. AgentIssue protects the actions autonomous systems take.

LLM / Agent

AgentIssue

External system

crm.updateexecuted
database.deletestopped
aws.terminate_instancewaiting, then executed

Checked on every action

Identity, Tool, Parameters, Environment, Policy, Risk

Any system an agent can reach

AWS, Stripe, Postgres, Slack, Salesforce, GitHub

Names are examples of tools, not partnerships.

See exactly what your agents tried to do.

Every evaluation becomes a trace with the request, the context, the policy it matched, and the reason. Select a row to expand it.

Request
{ "environment": "production", "table": "customers", "rows": 18432 }
Context
production, destructive operation, 18,432 rows affected
Matched policy
prod-destructive-actions
Decision
BLOCK
Reason
Destructive production actions require explicit human approval.
Execution
Not executed, approval requested

Add AgentIssue in a few lines.

Wrap the moment your agent is about to call a tool. The decision comes back with a reason and a trace id.

guard.py

from agentissue import AgentIssue

guard = AgentIssue(api_key="...")

decision = guard.evaluate(
    agent="support-agent",
    tool="stripe.refund",
    arguments={
        "customer_id": "cus_123",
        "amount": 12000
    }
)

if decision.allowed:
    execute_action()

guard.ts

import { AgentIssue } from "@agentissue/sdk";

const guard = new AgentIssue({ apiKey: "..." });

const decision = await guard.evaluate({
  agent: "support-agent",
  tool: "stripe.refund",
  arguments: { customerId: "cus_123", amount: 12000 },
});

if (decision.allowed) {
  await executeAction();
}

curl

curl -X POST https://api.agentissue.tech/v1/evaluate \
  -H "Authorization: Bearer $AGENTISSUE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent": "support-agent",
    "tool": "stripe.refund",
    "arguments": { "customer_id": "cus_123", "amount": 12000 }
  }'

{ "decision": "allow", "risk": "medium", "trace_id": "tr_8f21" }

Where teams put the policy layer first.

The riskiest actions cluster in a few places. Most teams start with one of these and expand.

Production protection
Prevent agents from modifying production systems without authorization.
k8s.delete_namespace in productionBLOCK
Financial controls
Require approval for refunds, transfers, subscriptions, or payment operations above a limit.
stripe.refund for $480.00REQUIRE_APPROVAL
Data protection
Stop agents from accessing or modifying sensitive customer information.
crm.export with field ssnBLOCK
Tool governance
Control exactly which tools agents can invoke and under what conditions.
slack.post to #supportALLOW

Give agents capability without giving them unlimited authority.

Policy-first
Security rules live outside the agent prompt, in versioned configuration your security team can review.
Explainable decisions
Every block or approval carries the matched policy and a plain reason. Nothing to argue with.
Framework agnostic
Works regardless of the model, agent framework, or tool provider. If it can make a tool call, AgentIssue can evaluate it.

ModelsClaude, OpenAI, Gemini, custom modelsFrameworksLangGraph, CrewAI, custom agents

Compatibility targets. AgentIssue is independent and not affiliated with or endorsed by any of these providers.

Prompts are not permission systems.

An instruction like “Never delete production data” is not a security boundary. It is a suggestion to a model that can be confused, jailbroken, or wrong about what counts as production.

AgentIssue enforces policies outside the agent’s reasoning loop, so the agent cannot ignore or reinterpret them.

Prompt instructioninside the model

“Do not delete production data.”

Interpreted by the model every time
Overridden by whatever comes later in the context
Fails silently, with no record

database.deletemaybe executes

Enforced policyoutside the model

database.delete + production
→ BLOCK

Evaluated by code, deterministically
Cannot be changed from inside the conversation
Every decision logged with a reason

database.deletenever executes

Frequently asked questions

How AgentIssue works, who it is for, and what early access means.

What is AgentIssue?: AgentIssue is safety infrastructure for autonomous AI agents. It evaluates tool and action requests before execution and returns a decision to allow, block, or require human approval.
How does AgentIssue fit into an agent application?: The application checks an action with AgentIssue before executing it. Policies evaluate the agent identity, permissions, tool, arguments, environment, and risk. The application uses the returned decision to control execution.
Who is AgentIssue for?: AgentIssue is for teams building agents that interact with production APIs, infrastructure, payments, or customer data.
Is AgentIssue publicly available?: AgentIssue is in private alpha. The landing page contains illustrative policy and integration examples. Request early access to discuss availability and integration with your team; submitting a request does not create an account or grant access automatically.
What happens when I request early access?: Your email, company or project, and description are saved for the AgentIssue team to review. The team may contact you using the email you provide. No account, API key, or automatic confirmation email is created by this form.

Building agents with real-world permissions?

We’re working with teams building autonomous systems that interact with production APIs, infrastructure, and customer data.

AgentIssue is in private alpha. Early access is hands-on: we help you write the first policies and wire the SDK into your agent loop.

Stop AI agents before they do something they shouldn’t.

AI agents are becoming more capable. Their permissions are becoming more dangerous.

Every action gets evaluated before execution.

Intercept

Evaluate

Decide

Audit

Policies your agents cannot ignore.

The firewall for AI agents.

See exactly what your agents tried to do.

Add AgentIssue in a few lines.

Where teams put the policy layer first.

Production protection

Financial controls

Data protection

Tool governance

Give agents capability without giving them unlimited authority.

Policy-first

Explainable decisions

Framework agnostic

Prompts are not permission systems.

Frequently asked questions

Building agents with real-world permissions?