AI agent governance

Four moments where control is possible

Agent governance is often discussed as a single thing, which makes it hard to evaluate. It is easier to reason about as four distinct moments, each with a different failure mode.

Before the model call

Content that should never be processed is blocked on the way in. This is the only control that can stop a prompt injection attempt or an unsafe request before it consumes a token.

Before the action

The model has decided to do something. Whether that decision executes unattended, or waits for a person, is the highest-stakes control in the system, because it is where an agent stops being advisory.

Around the configuration

Who can edit the workflow, see the credential, share the board, or change the approval rule. An approval step that anyone can delete is not a control.

After the fact

What can be reconstructed a week later: which prompt, which tool arguments, which reviewer, which cost. This is the control that turns an incident into a finding rather than an argument.

How Heym implements each moment

Each control below sits on the execution path, which means a workflow cannot route around it by forgetting to call something.

Guardrails on the node

Guardrails are configured directly on LLM and Agent nodes and cover violence, hate speech, sexual content, harassment, illegal activity, personal-data requests, and prompt injection attempts, across languages. A blocked message throws a typed workflow error that an Error Handler node can route like any other failure.

Human review as a checkpoint

An agent can request human review mid-run. The execution snapshots its full state and issues a one-time review link where a reviewer accepts, edits and continues, or refuses. A single run can pause more than once, and an optional review branch fires a notification flow when it does.

Approval scopes for tools

Written review guidelines are interpreted into approval scopes, so low-risk MCP and agent tools can be auto-approved while high-risk ones escalate. That keeps the approval queue small enough that people actually read it.

Permissions and credentials

Role-based team permissions govern who can view and edit, credentials are stored encrypted, and shared surfaces run with the owner’s credentials so collaborators never need their own copies of a secret.

Identity you already run

Sign-in authenticates against your own OpenID Connect provider using Authorization Code with PKCE, with optional auto-provisioning limited to an email domain allowlist.

An audit trail that leaves the box

Privileged actions are recorded as structured events and stream to your own log collector or SIEM, including configuration changes such as an administrator editing the sign-on settings, without ever recording the secret itself.

Reconstruction after the fact

Traces hold the payloads, tool arguments, timing, and USD cost for every model call, and execution history records which instance ran what, so a question about a specific run has one place to be answered.

Governance is what lets agents move faster

The framing that governance slows agents down assumes the alternative is agents acting freely. In practice the alternative is agents not being allowed into production at all, or being allowed in with a human manually checking every output, which is slower than any approval queue.

A well-scoped approval policy is what makes the difference: auto-approve the tool calls that cannot cause harm, escalate the ones that can, and record all of them. The queue stays short, the risky action still stops, and the agent handles the other ninety percent unattended.

Questions worth asking before you commit

These apply to any candidate, Heym included. They are the questions whose answers are hard to change later.

1. 1

   Can an approval actually block execution?

   A notification that a thing happened is not an approval. Ask whether the run stops and waits, and what holds its state while it does.

2. 2

   Are guardrails on the path or beside it?

   Policy enforced by a separate service that the workflow must remember to call is policy that will eventually be skipped.

3. 3

   Can approval rules be scoped per tool?

   All-or-nothing approval produces either an unread queue or an unguarded agent. Look for per-tool scopes.

4. 4

   Does the audit trail leave the product?

   An audit view inside the vendor’s UI cannot be correlated with the rest of your security telemetry. Look for structured events you can ship to your own collector.

5. 5

   Who can change the controls?

   Check whether editing a workflow, a credential, and an approval rule are separately permissioned, and whether a collaborator can silently overwrite an owner’s secret.

6. 6

   Is cost part of governance?

   Spend is a control surface too. Thresholds on token and dollar spend over a window catch a runaway loop before the invoice does.