Enforced at runtime

Govern every action an agent can take.

Which tools it can call, how much it can spend, which secrets it can use, which actions need a human's sign-off, the network boundary it runs inside — none of it lives in the prompt. sypho enforces it at runtime.

Request access View docs

Agent decision

↓

Runtime policy check

↓

Allowed action

↓

Observed result

Control cannot live only in the prompt.

Prompts can guide behavior, but they aren't enforcement boundaries. When an agent calls a tool, activates a skill, queries knowledge, accesses a secret, or creates a side effect, the runtime needs to know what's allowed before it happens — not hope the prompt worked.

Prompt instruction

→ asks the agent to behave

Runtime control

→ validates and enforces actions

prompts can be ignored or misinterpreted

tool calls create real side effects

permissions vary by tool and deployment

sensitive actions can require a human to approve first

spend should stop a run before it runs away

every action should be recorded after execution

Control the surfaces where agents create risk.

Runtime behavior isn't accidental. Policies attach to deployments and apply during execution — configured, enforced, and observed the same way every time.

Deployment policy

├─ tools

├─ knowledge

├─ secrets

├─ budget

├─ approvals

└─ network

Tool policy

which tools can be called, by exact name, glob, or pattern

Knowledge policy

which structured-data namespaces and keys the agent can read or write

Secrets policy

which credentials are resolved and injected at call time

Budget policy

the spend cap a run is not allowed to exceed

Approval policy

which tools pause for human approval before they execute, regardless of what the agent intended

Network policy

the sandbox boundary the agent container cannot reach outside of

Every tool call is a runtime event.

Tool calls are where agent behavior becomes system behavior. sypho checks every call against the run's declared tools and budget before it reaches the real upstream, then records the result in the trace.

{
  "tool": "refund_payment",
  "args": {
    "order_id": "ord_2481",
    "amount": 120
  },
  "status": "rejected",
  "reason": "Tool \"refund_payment\" is not in scope for this run"
}

enforce the run's exact allowed tools

reject undeclared tool calls

pause for human approval on flagged tools, before they run

resolve secrets just-in-time, never in agent code

stop a run that exceeds its budget

record every call and result in the run trace

Skills and knowledge stay scoped, not shared.

An agent only sees the structured data it's explicitly scoped to for that deployment. sypho makes skills and knowledge part of the runtime contract.

Skills

Skills package reusable instructions, resources, and executable workflows. sypho attaches them to deployments and records when they are activated.

Knowledge

Knowledge scopes define which structured-data namespaces and keys an agent can read or write. sypho keeps context explicit, scoped, and observable.

Every run can narrow what the deployment allows.

A deployment declares a default set of tools, budget, and data access. Any run can tighten that further — deny a specific tool, cap spend, scope data access — without touching the agent's code.

deployment default

this run

tools

46 declared

3 declared

refund_tool

allow

denied

wire_transfer

allow

requires approval

tickets

read_write

read

budget

no cap set

$0.50

Control that holds up in production.

Enforceable boundaries

Move critical controls out of prompts and into runtime policy.

Safer tool usage

Enforce exact tool permissions, required approvals, and spend limits before actions execute.

Scoped context

Limit structured-data access by deployment and namespace.

Operational accountability

Record actions, approvals, results, and spend in the run trace.

Per-run governance

Override tools, budget, and data access for a single run without touching agent code.

Control agents before they touch real systems.

Request access and help shape runtime control for production agents.

Request access