🛡️ Runtime governance for AI agents

Give your AI agents the power to act — without the risk.

Parapet decides what every agent is allowed to do, the instant it tries — in-process, deterministically, and without ever reading your users' data. One policy surface for authorization, guardrails, quality & hallucination evals, and human review.

Native to the Microsoft Agent Framework · framework-agnostic tracing · content-free by design.
agent.py
# One line turns any agent into a governed one.
- agent = Agent(client, tools=[refund, delete_records, send_email])
+ agent = GovernedAgent(client, tools=[refund, delete_records, send_email])

# Now every tool call is authorized in-process, before it runs:
#   allow  "refund"          as SupportAgent
#   deny   "delete_records"  forbidden by policy
#   deny   "send_email"      identity lacks the role
The gap

Agents don't just talk anymore. They do.

The moment an agent can call a tool, hit an API, or move money, a single wrong decision becomes a real-world action. Teams see it as their #1 barrier to shipping — and the tools they reach for tell them what happened, not what's allowed to happen.

#1
Quality & hallucination is the top barrier teams cite to putting agents in production.
~10
Separate tools a team wires together today to protect one agent use case.
0
Observability platforms that stop a specific action, tied to identity, at runtime.
Why now

A $50 billion market — arriving faster than the controls for it.

Autonomous, action-taking agents are moving into the enterprise core in under three years, and the market is compounding at ~46% a year. The risk controls haven't kept pace.

$5.4B
2024
$11.5B
2026
$24.4B
2028
$50.3B
2030
Global AI-agents market, USD. Source: Grand View Research (2025).
$50.3B
AI-agents market by 2030 — a 9× jump from $5.4B in 2024.
45.8%
compound annual growth rate, 2024–2030. Grand View Research
33%
of enterprise apps will embed agentic AI by 2028 — up from under 1% in 2024. Gartner
15%
of day-to-day work decisions will be made autonomously by 2028. Gartner
40%
of agentic-AI projects will be scrapped by end of 2027 — driven partly by inadequate risk controls. Gartner
What Parapet does

Everything an agent needs to be trusted — in one place.

Stop stitching a guardrail library to an eval framework to a tracing vendor to a hallucination model. Parapet is one policy surface, enforced inside your agent.

🔑

Identity-scoped action authorization

Deterministic, default-deny policy (Cedar) decides whether this agent, acting as this user, may take this action — the moment it tries.

🧱

Guardrails in & out

Scan inputs for secrets, PII, and prompt injection; score outputs for groundedness and deny hallucinated responses before they reach the user.

🧪

Quality, factuality & hallucination evals

A tiered judge — deterministic, a small local model (SLM), or an LLM-as-judge — offline and at runtime. Cheap checks first; escalate only when needed. Then govern the verdict: enforce it in-process and diff runs to catch regressions.

👍

Human review loop

Flag a decision, triage it in a review queue, and turn it into a regression test in one click.

🔒

Content-free where it governs

Authorization decisions and the audit trail use the action and identity only — never your prompt or response text. Quality and guardrail checks that must read text do so in-process and locally, and keep nothing.

In-process, no proxy

Runs as middleware inside your agent — no sidecar, no network hop, no new box to operate. Fails closed.

Where Parapet fits

Four layers secure your agent. One decides what it's allowed to do.

Identity, containment, detection, and observability are real, funded categories — and you want all of them. But each answers a different question. None decides, deterministically and per-identity, whether a specific action is allowed the moment the agent takes it. That layer is Parapet, and it sits on top of the others.

Identity
Who is the agent?
Microsoft Entra Agent ID · Okta · Auth0
Containment
Where can it run?
Microsoft Execution Containers
Detection
Does this look like an attack?
Lakera · Prompt Security · Straiker
Observability & eval
What happened, after the fact?
Arize · Galileo · LangSmith
Action authorization
Is this action allowed — for this identity, right now?
Parapet

Identity says who the agent is. Containment says where it can run. Parapet says what it's allowed to do. It consumes the agent identity you already issue — it is not another identity provider — and enforces fine-grained policy above OS-level containment. Complementary to Microsoft Agent 365 and Entra, Okta, and your observability stack — not a replacement for any of them. The market has raised $240M+ for the top layers (LangChain, Arize, Galileo) and roughly $0 for identity-scoped action authorization: the category is validated, this layer is open.

Built for the enterprise agent problem

Four problems every agent program hits. One control plane for all of them.

Not abstractions — each block below is a problem enterprise teams bring us, mapped to the specific piece of the Parapet SDK or control plane that addresses it.

01

Agents are proliferating faster than anyone can track them.

Support bots, ServiceNow copilots, internal RAG assistants — spun up by different teams, on different clouds, different models, different frameworks, usually outside any central registry. You can't govern what you can't see.

🗂️

One fleet inventory, automatically

Every agent behind a Parapet PEP registers with the control plane and reports its identity, the models it calls, the tools it's allowed to reach, and live allow/deny activity — a fleet view that builds itself instead of a spreadsheet nobody maintains.

🌐

Cloud-, model- & framework-agnostic by construction

Parapet governs by intercepting the base-URL environment variable every OpenAI-compatible SDK already reads — no MITM, no CA to distribute, no app code to rewrite. Agents on Microsoft Agent Framework, LangChain/LangGraph, CrewAI, AutoGen, or a bare client, on any cloud, land in the same inventory.

Control plane · Fleet
AgentFrameworkModelToolsStatus
support-triageMAFgpt-4o-mini4enforcing
it-ticket-botLangGraphllama-3.1-70b7enforcing
sales-researchCrewAIclaude-sonnet3observe mode
hr-onboardingAutoGengpt-4o5enforcing
02

A single agent turn now touches many real systems.

Agents don't just chat — in one multi-turn session they open a ticket, pull a doc, and update a CRM record; in a multi-agent setup they hand off to each other. One wrong call cascades across systems before a human ever sees it.

🔑

Authorization at every level

Cedar policy decides per end user (role/claims), per agent identity, per tool call — inspecting the call's own arguments — and per model, before anything executes. Not one coarse on/off switch.

Gateway + in-process, not either/or

A network-level gateway is a real boundary but can't see intent. In-process SDK middleware makes the fine-grained call with no network hop, while signed policy bundles push straight into the running agent's memory — enforcement adds no latency, and a policy change takes effect immediately.

🔗

Follow the turn across systems

Every model and tool call in a session is a span in one trace, each with its own allow/deny decision, nested under the same session ID — so a chain across tools is something you see and stop in real time, not reconstruct afterward.

🙋
End user
role: agent_ops
🤖
Agent
it-ticket-bot
🎫
ServiceNow
create_ticket · allow
📄
Confluence
fetch_kb_article · allow
🧾
Salesforce
update_opportunity · deny
Gateway layer: network boundaryIn-process layer: the deny above — decided in-agent, zero round trip
03

You can't unit-test your way to a trustworthy agent.

The same prompt can produce a different — and differently wrong — answer tomorrow. Testing has to shift from pass/fail assertions to layered, context-sensitive evaluation.

🧱

Runtime guardrails, tier 1

Deterministic Cedar rules and regex/checksum entity scanners (e.g. Luhn-validated card numbers) run on every call. No model in the loop, no meaningful latency added.

🧪

Local & LLM-as-judge, tier 2–3

A local groundedness model (Vectara HHEM) scores a high share of traffic content-free; an LLM-as-judge scores factuality against any OpenAI-compatible endpoint — including a small local model — when a call needs real judgment.

👍

SME human review, tier 4

Flagged decisions land in a review queue. A reviewer's thumbs up/down becomes ground truth — promoted straight into a regression test, not just a note in a spreadsheet.

Tier 1Deterministic guardrails
every call
Tier 2Local SLM judge
high share
Tier 3LLM-as-judge
as needed
Tier 4SME human review
flagged
04

A release-gate eval doesn't catch what happens Wednesday.

A model that passed CI on Tuesday can hallucinate, mis-call a tool, or reason its way into a bad decision on Wednesday. Reliability needs continuous monitoring and a feedback loop back into the agent — not a one-time gate.

📡

Session/trace/span visibility

Every decision streams to the control plane as a span in a trace, nested under a session — content-free by construction, so you see the shape of every run in production, not just the ones that got flagged.

📈

Recorded runs & comparison

Eval runs are recorded and diffed against each other — regressions, fixes, and still-failing cases surfaced automatically, so a prompt or policy change shows its blast radius before it ships wider.

🔁

Feedback that writes back

A flagged decision doesn't just get logged — observe mode turns real traffic into a suggested policy, and a reviewed case becomes a regression test. Production keeps making the agent better, continually.

🚦
Production traffic
agent.run()
📡
Traces & spans
content-free
🧪
Evals & flags
judge + review queue
📜
Policy & regression tests
observe mode → rule
🛡️
Back to production
governs the next run
How it works

Three lines from unprotected to governed.

01

Wrap the agent

Swap Agent(…) for GovernedAgent(…). That's the integration.

02

Author a policy

Say what's allowed in plain, versioned rules — or curate them from what your fleet actually did.

03

Enforce & observe

Every model and tool call is authorized in-process and streamed to the control plane — content-free.

☁️ Parapet Control
🧪 Evals
🔑 Governance
📡 Observability
⚙️ Data Plane
🤖 Agent
parapet-agent
🚪 Agent Gateway
🧠 Models / Tools
Built for developers

Adopt it in one line. Keep your stack.

No proxy, no sidecar, no new box to run. Parapet is middleware inside your agent — pip install, wrap the agent, write a small policy. It runs in your infrastructure and fails closed.

$ pip install parapetai-agentcopy
agent.py
from parapetai_agent import GovernedAgent

agent = GovernedAgent(
    client=client,
    tools=[refund, delete_records, send_email],
    policy_dir="policies/",   # plain, versioned rules
)

# Every tool call + response is now authorized,
# guarded, and scored — in-process, content-free.
await agent.run("issue a refund for order 4471")
🧩 Native to the Microsoft Agent Framework

One-line wrap. Other frameworks plug in via OpenTelemetry.

MAF · nativeLangChainLangGraphCrewAIAutoGenOpenAI Agents
📖 Open source, free in CI

Prove containment from your code before you ship — AutonomyProof CLI, Apache-2.0, on PyPI. No account required.

🔐 Runs in your infra

In-process and fail-closed. Deterministic Cedar policy. Nothing sensitive leaves the process.

See it

Same agent. Same task. One line of difference.

A real customer-support agent — a genuine open-source model (Qwen2.5-3B, run locally) on the Microsoft Agent Framework — is told to wipe a customer's records. We ran it twice.

UngovernedNO PARAPET
Model decided: call delete_records("4471")
Tool call: executed — nothing in the way
Production records: 12,405 → 0
💥 Database wiped — 12,405 records deleted
Parapet-governedGOVERNED
Model decided: call delete_records("4471") (same choice)
Parapet decision: DENY — forbidden by policy, tool name only
Production records: 12,405 → 12,405
🛡️ Blocked in-process — tool never ran

This is a real, unmocked run: real agent framework, real local open-source model, real tool execution, real Cedar decision. The model made the identical choice both times — Parapet is the only difference.100% real run

Watch the animated flow + product screens →
Open core

Prove containment for free. Enforce it in production when you're ready.

Start in CI at no cost with the open-source CLI, and upgrade to the Parapet control plane when you're running agents for real.

Open source · free

AutonomyProof CLI

$0 — Apache-2.0, on PyPI
  • Proves containment from your code, in CI, before you ship
  • Static analysis + a GitHub Action
  • Your top-of-funnel: catch unsafe agents pre-production
  • No account required
Install the CLI
The product · paid

Parapet Control Plane

Runtime governance for teams
  • In-process enforcement across your whole fleet
  • Identity-scoped authorization, guardrails in & out
  • Evals, run comparison, and the human-review queue
  • Multi-tenant, RBAC, SSO, content-free audit trail
Sign up for the control plane →
FAQ

AI agent governance, answered.

What is AI agent governance?
AI agent governance is the discipline of controlling what an autonomous AI agent is allowed to do at runtime — which tools it may call, which actions it may take, and on whose behalf — and enforcing that in real time. Parapet does this in-process with a deterministic, default-deny policy engine, so an unsafe action is denied before it runs, not flagged after.
How is Parapet different from LLM observability and eval tools?
Observability and eval platforms (LangSmith, Langfuse, Arize, Braintrust, Laminar, and peers) tell you what your agent did — traces, dashboards, offline evals. They watch. Parapet decides: it authorizes each action the instant the agent tries it. You typically want both — keep your observability stack for insight, add Parapet for runtime control.
Does Parapet evaluate prompts and responses, and catch hallucinations?
Yes. Parapet evaluates response quality two ways: offline, by scoring prompt/response pairs with deterministic checks or an LLM-as-judge for factuality; and at runtime, with a groundedness check that denies ungrounded or hallucinated responses before they reach the user (plus input guardrails for PII, secrets, and prompt injection). Governance stays content-free; these quality checks read the text in-process, locally, and keep nothing.
Does Parapet support an SLM judge (small language model as judge)?
Yes — the judge is tiered. A dependency-free deterministic check runs first; then a small local model — the Vectara HHEM cross-encoder — judges groundedness; and an LLM-as-judge scores factuality against any OpenAI-compatible endpoint, including a small local model (for example via Ollama). SLM judges run locally and content-free, so you can score a high share of traffic cheaply. The Parapet difference: the judge's verdict doesn't just get logged — it feeds a deterministic policy that's enforced in-process and regression-tested. Governance of the judge, not just another judge.
Can Parapet stop an agent from calling a specific tool or taking an action?
Yes — that's the core. A deterministic Cedar policy decides whether this agent, acting as this identity, may perform this action. Forbidden tool calls (say delete_records or send_payment) are denied in-process and never execute. Default-deny and fail-closed: if a check can't run, the action is denied.
Does Parapet read or store my prompts and user data?
No. Parapet is content-free by design: decisions are made from the action name and the caller's identity, not the prompt or response text. Nothing sensitive is captured, stored, or sent anywhere — which is often what makes a security or compliance team comfortable running it at all.
Which agent frameworks does it work with?
Parapet is native to the Microsoft Agent Framework — one line turns Agent(…) into GovernedAgent(…). It also ingests OpenTelemetry traces from other frameworks (LangChain/LangGraph, CrewAI, AutoGen, OpenAI Agents) so you can observe agents built anywhere while enforcing in-process where it counts. Tool calls made over MCP (Model Context Protocol) are governed the same way as native tools — each MCP action is authorized against policy before it runs.
Isn't Microsoft Agent 365 (Entra Agent ID, Execution Containers) already doing this?
They cover adjacent layers, and Parapet is designed to sit on top of them, not replace them. Entra Agent ID gives an agent an identity and coarse permissions to resources and APIs — Microsoft's own docs note that runtime, action-level authorization is out of scope. Microsoft Execution Containers enforce at the OS level: which files, networks, and processes an agent may touch. Neither decides whether a specific action — this refund, this deletion, for this user, right now — is allowed by your business policy, in-process. That fine-grained, identity-scoped decision is Parapet's job, and it consumes the Entra identity you already issue.
Does Parapet help with AI compliance (EU AI Act, NIST AI RMF, ISO 42001)?
Parapet produces the kind of evidence these frameworks ask for: enforced, versioned, default-deny policy for high-risk actions; a content-free audit trail of every decision; and human-in-the-loop review. It maps naturally to the risk-management and human-oversight expectations in the EU AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001. Parapet is a control you operate, not a certification — but it gives auditors a provable record of what agents were and were not permitted to do.
How is runtime governance different from “guardrails”?
Guardrails usually mean content checks — blocking PII, secrets, or prompt injection in the text. Parapet includes those, but adds the piece guardrail libraries don't: identity-scoped action authorization. It governs both the content (in and out, including groundedness) and the actions, on one policy surface.
Is there a free version?
Yes. The open-source AutonomyProof CLI (Apache-2.0, on PyPI) proves containment from your code in CI, for free. The Parapet control plane is the paid product for enforcing governance across your fleet at runtime.

Let your agents act. Keep the guardrail.

Governance that lives inside the agent — deterministic, content-free, and one line to adopt.

Sign up for the control plane → Watch the demo