Loading…
Execution pattern
Control MCP egress
Decide what leaves before it leaves, at the tool-call boundary.
What executes
An agent calls a tool that reaches a network destination, uploads a file, or posts data to a third party.
What normally goes wrong
Egress is invisible until it is a disclosure. The model did not decide to exfiltrate; it composed two allowed capabilities into one that nobody sanctioned.
The decision
The signals available at the moment of the action, and the rule that judges them.
Signals
- Destination host and whether it is on an allowlist
- Classification of the data in the payload
- Whether the tool was approved for this actor
- Prior calls in the same session
The gate
Permit egress only to destinations on the allowlist, and refuse any payload carrying classified data regardless of destination.
ALLOW
The tool call proceeds to an approved destination.
ESCALATE
An unrecognised destination waits for someone to sanction it.
BLOCK
The call does not leave; the dossier records what would have been sent.
Four stages left to right. Input signals — user or agent identity, context and data, tools and resources, spend and budget, policies, history and reputation, and environment — enter the Decionis Protocol. Inside, the protocol normalizes context and intent, evaluates policies and rules, runs a deterministic risk and policy engine, and explains the reason and evidence. It emits a verdict: ALLOW (authorized), ESCALATE (needs approval or more info), or BLOCK (high risk or out of policy). The verdict drives an enforcement action: allow, block, require approval, or throttle and limit. Every decision is recorded for audit, learning, and continuous improvement.
8 policies implement this pattern
Fork one and change the thresholds. Available today on 6 platforms.
Copilot Agent Tool Whitelist
Only the tools you approved fire. Everything else is denied at the pre-tool boundary with a reason the agent can read.
copilot
AWS Agent Egress & Spend Gate
Opens sandbox egress only for the exact target the grant covers, and stops a run that would blow the account budget.
aws
Claude Code Destructive-Shell Gate
Never let an agent run `rm -rf`, a force-drop, or a disk-level command without a human approval on the tool call.
claude code
Claude Code Secrets & Credentials Guard
Stops an agent reading, printing, or committing credential files, and escalates any command that would rotate a secret.
claude code
Codex Blast-Radius Gate
Scores every Codex tool call by blast radius and escalates anything that could touch production before it runs.
codex
LangChain Money-Moving Tool Gate
Wrap `send_refund`, `issue_payout`, or any tool that moves money — the inner tool only fires on an approve verdict.
langchain
LangChain Regulated-Data RAG Gate
Gates retrieval and external API calls that touch regulated records — restricted subjects never leave the boundary.
langchain
Vertex AI Tool-Execution Gate
Gates the extension call a Vertex AI model wants to make, so an out-of-scope or unapproved tool never executes.
vertex ai
Related concepts
This pattern is one answer to each of these.
What to do next
The same five steps for every pattern in the library.
- Simulate this recipe
Run the policy against a realistic action in the browser. Push it past what the rules allow and watch the verdict come back. No account.
- View the signed Decision Dossier
See exactly what was decided and why: the rule that fired, the evidence it read, the policy version in force, and an Ed25519 signature you can verify yourself.
- Deploy in shadow mode
Measure what the policy would have caught on your own traffic without touching the live path. Every recipe defaults to shadow, so the first deployment carries no execution risk.
- Connect a real workflow
Point the same policy at the system where the action actually originates — a checkout, an ERP posting, a Zap, an agent's tool call.
- Share the verified result
Publish the proof: a public verification link, an embeddable badge, a PR comment, or an anonymized shadow-mode finding. This is how the next person discovers Decionis.