Parapet decides what every agent is allowed to do, the instant it tries — in-process, deterministically, and without ever reading your users' data. One policy surface for authorization, guardrails, quality & hallucination evals, and human review.
# One line turns any agent into a governed one. - agent = Agent(client, tools=[refund, delete_records, send_email]) + agent = GovernedAgent(client, tools=[refund, delete_records, send_email]) # Now every tool call is authorized in-process, before it runs: # allow "refund" as SupportAgent # deny "delete_records" forbidden by policy # deny "send_email" identity lacks the role
The moment an agent can call a tool, hit an API, or move money, a single wrong decision becomes a real-world action. Teams see it as their #1 barrier to shipping — and the tools they reach for tell them what happened, not what's allowed to happen.
Stop stitching a guardrail library to an eval framework to a tracing vendor to a hallucination model. Parapet is one policy surface, enforced inside your agent.
Deterministic, default-deny policy (Cedar) decides whether this agent, acting as this user, may take this action — the moment it tries.
Scan inputs for secrets, PII, and prompt injection; score outputs for groundedness and deny hallucinated responses before they reach the user.
A tiered judge — deterministic, a small local model (SLM), or an LLM-as-judge — offline and at runtime. Cheap checks first; escalate only when needed. Then govern the verdict: enforce it in-process and diff runs to catch regressions.
Flag a decision, triage it in a review queue, and turn it into a regression test in one click.
Authorization decisions and the audit trail use the action and identity only — never your prompt or response text. Quality and guardrail checks that must read text do so in-process and locally, and keep nothing.
Runs as middleware inside your agent — no sidecar, no network hop, no new box to operate. Fails closed.
LLM observability, tracing, and eval platforms are necessary — they show you the past so you can debug and improve. But they watch; they don't decide. When an AI agent can call a tool, move money, or delete data, you need something that authorizes the action at runtime, before it happens. That's agent governance, and it's a different job.
The category you already know — LangSmith, Langfuse, Arize, Braintrust, Laminar, and peers.
Traces, dashboards, offline evals, cost & latency. Answers “what happened?” — after the fact, by reading your prompts and responses.
Authorizes every action in-process, the moment the agent tries it.
Identity-scoped, deterministic, default-deny policy. Answers “is this allowed?” — before it runs, from the action and identity alone, never your data.
You want both. Keep your observability stack for insight; add Parapet for control. Parapet also covers the guardrails (secrets, PII, prompt injection, groundedness), evals, and regression testing that would otherwise be four more tools to wire together.
Not abstractions — each block below is a problem enterprise teams bring us, mapped to the specific piece of the Parapet SDK or control plane that addresses it.
Support bots, ServiceNow copilots, internal RAG assistants — spun up by different teams, on different clouds, different models, different frameworks, usually outside any central registry. You can't govern what you can't see.
Every agent behind a Parapet PEP registers with the control plane and reports its identity, the models it calls, the tools it's allowed to reach, and live allow/deny activity — a fleet view that builds itself instead of a spreadsheet nobody maintains.
Parapet governs by intercepting the base-URL environment variable every OpenAI-compatible SDK already reads — no MITM, no CA to distribute, no app code to rewrite. Agents on Microsoft Agent Framework, LangChain/LangGraph, CrewAI, AutoGen, or a bare client, on any cloud, land in the same inventory.
| Agent | Framework | Model | Tools | Status |
|---|---|---|---|---|
| support-triage | MAF | gpt-4o-mini | 4 | enforcing |
| it-ticket-bot | LangGraph | llama-3.1-70b | 7 | enforcing |
| sales-research | CrewAI | claude-sonnet | 3 | observe mode |
| hr-onboarding | AutoGen | gpt-4o | 5 | enforcing |
Agents don't just chat — in one multi-turn session they open a ticket, pull a doc, and update a CRM record; in a multi-agent setup they hand off to each other. One wrong call cascades across systems before a human ever sees it.
Cedar policy decides per end user (role/claims), per agent identity, per tool call — inspecting the call's own arguments — and per model, before anything executes. Not one coarse on/off switch.
A network-level gateway is a real boundary but can't see intent. In-process SDK middleware makes the fine-grained call with no network hop, while signed policy bundles push straight into the running agent's memory — enforcement adds no latency, and a policy change takes effect immediately.
Every model and tool call in a session is a span in one trace, each with its own allow/deny decision, nested under the same session ID — so a chain across tools is something you see and stop in real time, not reconstruct afterward.
The same prompt can produce a different — and differently wrong — answer tomorrow. Testing has to shift from pass/fail assertions to layered, context-sensitive evaluation.
Deterministic Cedar rules and regex/checksum entity scanners (e.g. Luhn-validated card numbers) run on every call. No model in the loop, no meaningful latency added.
A local groundedness model (Vectara HHEM) scores a high share of traffic content-free; an LLM-as-judge scores factuality against any OpenAI-compatible endpoint — including a small local model — when a call needs real judgment.
Flagged decisions land in a review queue. A reviewer's thumbs up/down becomes ground truth — promoted straight into a regression test, not just a note in a spreadsheet.
A model that passed CI on Tuesday can hallucinate, mis-call a tool, or reason its way into a bad decision on Wednesday. Reliability needs continuous monitoring and a feedback loop back into the agent — not a one-time gate.
Every decision streams to the control plane as a span in a trace, nested under a session — content-free by construction, so you see the shape of every run in production, not just the ones that got flagged.
Eval runs are recorded and diffed against each other — regressions, fixes, and still-failing cases surfaced automatically, so a prompt or policy change shows its blast radius before it ships wider.
A flagged decision doesn't just get logged — observe mode turns real traffic into a suggested policy, and a reviewed case becomes a regression test. Production keeps making the agent better, continually.
Swap Agent(…) for GovernedAgent(…). That's the integration.
Say what's allowed in plain, versioned rules — or curate them from what your fleet actually did.
Every model and tool call is authorized in-process and streamed to the control plane — content-free.
No proxy, no sidecar, no new box to run. Parapet is middleware inside your agent — pip install, wrap the agent, write a small policy. It runs in your infrastructure and fails closed.
from parapetai_agent import GovernedAgent agent = GovernedAgent( client=client, tools=[refund, delete_records, send_email], policy_dir="policies/", # plain, versioned rules ) # Every tool call + response is now authorized, # guarded, and scored — in-process, content-free. await agent.run("issue a refund for order 4471")
One-line wrap. Other frameworks plug in via OpenTelemetry.
Prove containment from your code before you ship — AutonomyProof CLI, Apache-2.0, on PyPI. No account required.
In-process and fail-closed. Deterministic Cedar policy. Nothing sensitive leaves the process.
A real customer-support agent — a genuine open-source model (Qwen2.5-3B, run locally) on the Microsoft Agent Framework — is told to wipe a customer's records. We ran it twice.
delete_records("4471")delete_records("4471") (same choice)DENY — forbidden by policy, tool name onlyThis is a real, unmocked run: real agent framework, real local open-source model, real tool execution, real Cedar decision. The model made the identical choice both times — Parapet is the only difference.100% real run
Start in CI at no cost with the open-source CLI, and upgrade to the Parapet control plane when you're running agents for real.
delete_records or send_payment) are denied in-process and never execute. Default-deny and fail-closed: if a check can't run, the action is denied.Agent(…) into GovernedAgent(…). It also ingests OpenTelemetry traces from other frameworks (LangChain/LangGraph, CrewAI, AutoGen, OpenAI Agents) so you can observe agents built anywhere while enforcing in-process where it counts.Governance that lives inside the agent — deterministic, content-free, and one line to adopt.