Stop runaway agents.Keep good work moving.
Set hard operating limits. Stop out-of-bounds actions before dispatch. Take control with a kill switch scoped to an agent, a tool or a namespace, and keep the decision trail.
Independent control for the agents you already run ↓✓The out-of-bounds call stops. The other sample workflows continue.
The run used its 50 permitted steps. Its next call is denied.
- Policy
- billing-guard
- Rule
- Iteration limit
- Tool
- ledger.update
- Execution
- Not dispatched
Set the limits. Let the agent work.
Define where an agent can act, when it can act and how far a run can go. GovernorAI applies those limits at the action boundary, before the next governed action proceeds.
Break the loop.
Cap repeated activity. Deny the next governed action when a run reaches its step limit instead of letting a stalled run keep calling tools.
Denied before dispatchKeep tools in scope.
Let agents use the connectors they need. Block calls to the ones outside their policy, at the boundary.
Denied before dispatchRespect the window.
Keep governed actions inside approved operating hours, even when the agent works around the clock.
Denied before dispatchPut a limit on time.
Set a maximum run duration. Stop further governed actions once the time is up.
Denied before dispatchActions above a declared tier pause at the boundary until an authorized reviewer attests. The hold fails closed: no attestation, no dispatch.
In the product
See containment in the console.
A recorded walk through the containment controls behind this page: alert rules with their thresholds, a destructive tool call held inline for a human before it ran, and a kill switch as it was recorded, with who pulled it, why, and at what scope.
Containment, step by step
Real product screens from a demo tenant with seeded activity. No rule, incident, approval or kill switch was created, changed or released while recording.
Stop one agent. Or widen the stop.
Limits set the boundary automatically. The kill switch puts intervention in your hands: choose an agent, a tool or a namespace, and decide how far the stop should reach. Every activation and release runs through one path and is recorded.
Choose the stop scope.
Preview the affected call paths, then apply a sample stop. You can layer scopes without clearing an active stop.
Selected target: Billing agent · all governed calls
Six sample runs · four agents · three tools · three namespaces
Previewing agent: 2 matching call paths, 2 newly affected. 4 outside this scope.
No sample activations.
Previewing another scope keeps active sample stops in place. Reset demo clears the simulation.
A threshold can open an incident.
Containment doesn't have to wait for a person to notice. A rule on what the governed path is seeing, scoped to a namespace, an agent or a policy, can open an incident with an owner. Engaging the kill switch stays an operator action.
What the path reports
Signals from decisions already being made, not a new sensor.
- deny rate
- error rate
- p95 / p99 latency
- request count
- queue depth
A rule, not a judgment
Threshold, window and scope. The same inputs resolve the same way every time.
- global
- namespace
- agent
- policy
Act on the threshold
Open an incident for an owner to work. An operator decides whether to stop anything.
- open an incident
Hard limits don't need a model's permission.
Your rule makes the call.
A count, a clock, a connector boundary. Limits are evaluated against the active policy and the run’s current context—not the model’s willingness to follow an instruction.
Set explicit operating rules at the action boundary. The model proposes the action; your policy decides whether it proceeds.
Govern without rebuilding your agents.
Put control at the gateway, proxy or agent host, with SDK integration where it fits. Keep your agent framework, identity systems and policy ownership.
From intent to evidence.
Version the policy, evaluate it before rollout, enforce it at runtime, and record the resulting decisions, allow or deny, for an auditor to read.
Containment is written as policy.
Keep one policy identity from discovery and assurance through runtime decisions and evidence. Version the limits, test them before rollout, and keep your existing OPA alongside.
- GovernorAI native or OPA/Rego, chosen per policy
- Templates for common runaway patterns, or a draft generated from observed activity for a human to approve
- Terraform provider and SDK for the full lifecycle
# one policy identity: discovery to evidence policy: billing-guard revision: 7 applies_to: agent/billing-reconciler limits: max_iterations: 50 max_wall_clock: 15m business_hours: window: "Mon-Fri 06:00-20:00" tz: America/Los_Angeles connectors: allow: [ledger.read, ledger.update, slack.post] deny: [payments.transfer] maker_checker: on: [ledger.update] when: amount > 10000 on_breach: deny # stopped before dispatch, recorded as evidence
A stop should come with an explanation.
What was attempted, what was decided, what was withheld. Gateway decisions are recorded as they are made, so the conversation after an intervention starts from a record, not a screenshot.
- Security sees what crossed the boundary and what didn't.
- Platform sees which policy and rule decided it.
- GRC gets decision records for reviewed control mappings.
- Agent
- Billing agent
- Policy
- billing-guard
- Triggered rule
- Iteration limit
- Attempted tool
- ledger.update
- Decision
- DENY
- Execution
- Not dispatched
- Decided by
- policy evaluation · no model in the loop
One containment strategy. Your existing AI stack.
Your agents don't all live in one framework. Bring the same operating limits and stop controls to the enforcement points your workflows already cross.
Keep runaway spend in view.
Cost is attributed to the agent and model that caused it, forecast from governed activity, and flagged when it leaves its baseline, so the spend curve is visible before it is a finance conversation.
Attribution
Spend per agent and per model, so a runaway is a name, not a line on an invoice.
Budgets and alerts
Thresholds with alerting, routed to the team that owns the agent.
Forecasting
Projected spend from what the governed path has already seen.
Anomaly detection
Spend that departs from its baseline, with severity and status.
A few practical questions.
Does containment replace our agent platform or security stack?
No. GovernorAI adds independent governance at the gateways, proxies and integration points your actions already cross. Keep the platforms, identity and policy engines you run; put the operating limits and stop controls at the boundary.
How do limits and the kill switch work together?
Limits deny actions that cross an operating rule, automatically. The kill switch blocks future governed actions for a selected agent, tool or namespace, on demand. Both are recorded.
Does a stop undo completed actions?
No. A kill switch does not reverse transactions that have already completed. It applies the selected stop scope to subsequent governed actions.
What does the published benchmark measure?
Full in-process engine evaluation in the published Apple M4 microbenchmark fixture. The method excludes transport, adapters, serialisation, I/O and audit writes; this is not end-to-end containment latency or an SLA. Full method
Autonomy, under control
Give agents room to run. Keep the stop in your hands.
Bring one workflow. We'll map its operating limits, exercise a scoped stop and review the decision trail with you.