Runtime Execution Control Has Two Layers. Most Vendors Only Sell You One.
In-process guardrails help agents try to behave well. Infrastructure-level enforcement proves they did. Production needs both — and it is critical to understand the difference before you buy.
Layer 1: In-process guardrails
SDK hooks, prompt engineering, model-level refusals, and client-side tool filters. Valuable for development and low-risk scenarios. Bypassable if the agent runtime holds credentials or can call APIs directly.
Layer 2: Infrastructure enforcement
Policy at the execution boundary: authorization before credential use, human approval on risky actions, policy-scoped discovery, revoke mid-run, and signed receipts. This layer survives prompt injection and credential theft because the agent never holds the key.
Buyers evaluating agent security should ask: which layer does this product actually enforce — and can it prove outcomes without trusting logs alone?
Related
How the Fabric works →