Parapet decides what every agent is allowed to do, the instant it tries — in-process, deterministically, and without ever reading your users' data. One policy surface for authorization, guardrails, quality & hallucination evals, and human review.
# One line turns any agent into a governed one. - agent = Agent(client, tools=[refund, delete_records, send_email]) + agent = GovernedAgent(client, tools=[refund, delete_records, send_email]) # Now every tool call is authorized in-process, before it runs: # allow "refund" as SupportAgent # deny "delete_records" forbidden by policy # deny "send_email" identity lacks the role
The moment an agent can call a tool, hit an API, or move money, a single wrong decision becomes a real-world action. Teams see it as their #1 barrier to shipping — and the tools they reach for tell them what happened, not what's allowed to happen.
Autonomous, action-taking agents are moving into the enterprise core in under three years, and the market is compounding at ~46% a year. The risk controls haven't kept pace.
Stop stitching a guardrail library to an eval framework to a tracing vendor to a hallucination model. Parapet is one policy surface, enforced inside your agent.
Deterministic, default-deny policy (Cedar) decides whether this agent, acting as this user, may take this action — the moment it tries.
Scan inputs for secrets, PII, and prompt injection; score outputs for groundedness and deny hallucinated responses before they reach the user.
A tiered judge — deterministic, a small local model (SLM), or an LLM-as-judge — offline and at runtime. Cheap checks first; escalate only when needed. Then govern the verdict: enforce it in-process and diff runs to catch regressions.
Flag a decision, triage it in a review queue, and turn it into a regression test in one click.
Authorization decisions and the audit trail use the action and identity only — never your prompt or response text. Quality and guardrail checks that must read text do so in-process and locally, and keep nothing.
Runs as middleware inside your agent — no sidecar, no network hop, no new box to operate. Fails closed.
Identity, containment, detection, and observability are real, funded categories — and you want all of them. But each answers a different question. None decides, deterministically and per-identity, whether a specific action is allowed the moment the agent takes it. That layer is Parapet, and it sits on top of the others.
Identity says who the agent is. Containment says where it can run. Parapet says what it's allowed to do. It consumes the agent identity you already issue — it is not another identity provider — and enforces fine-grained policy above OS-level containment. Complementary to Microsoft Agent 365 and Entra, Okta, and your observability stack — not a replacement for any of them. The market has raised $240M+ for the top layers (LangChain, Arize, Galileo) and roughly $0 for identity-scoped action authorization: the category is validated, this layer is open.
Not abstractions — each block below is a problem enterprise teams bring us, mapped to the specific piece of the Parapet SDK or control plane that addresses it.
Support bots, ServiceNow copilots, internal RAG assistants — spun up by different teams, on different clouds, different models, different frameworks, usually outside any central registry. You can't govern what you can't see.
Every agent behind a Parapet PEP registers with the control plane and reports its identity, the models it calls, the tools it's allowed to reach, and live allow/deny activity — a fleet view that builds itself instead of a spreadsheet nobody maintains.
Parapet governs by intercepting the base-URL environment variable every OpenAI-compatible SDK already reads — no MITM, no CA to distribute, no app code to rewrite. Agents on Microsoft Agent Framework, LangChain/LangGraph, CrewAI, AutoGen, or a bare client, on any cloud, land in the same inventory.
| Agent | Framework | Model | Tools | Status |
|---|---|---|---|---|
| support-triage | MAF | gpt-4o-mini | 4 | enforcing |
| it-ticket-bot | LangGraph | llama-3.1-70b | 7 | enforcing |
| sales-research | CrewAI | claude-sonnet | 3 | observe mode |
| hr-onboarding | AutoGen | gpt-4o | 5 | enforcing |
Agents don't just chat — in one multi-turn session they open a ticket, pull a doc, and update a CRM record; in a multi-agent setup they hand off to each other. One wrong call cascades across systems before a human ever sees it.
Cedar policy decides per end user (role/claims), per agent identity, per tool call — inspecting the call's own arguments — and per model, before anything executes. Not one coarse on/off switch.
A network-level gateway is a real boundary but can't see intent. In-process SDK middleware makes the fine-grained call with no network hop, while signed policy bundles push straight into the running agent's memory — enforcement adds no latency, and a policy change takes effect immediately.
Every model and tool call in a session is a span in one trace, each with its own allow/deny decision, nested under the same session ID — so a chain across tools is something you see and stop in real time, not reconstruct afterward.
The same prompt can produce a different — and differently wrong — answer tomorrow. Testing has to shift from pass/fail assertions to layered, context-sensitive evaluation.
Deterministic Cedar rules and regex/checksum entity scanners (e.g. Luhn-validated card numbers) run on every call. No model in the loop, no meaningful latency added.
A local groundedness model (Vectara HHEM) scores a high share of traffic content-free; an LLM-as-judge scores factuality against any OpenAI-compatible endpoint — including a small local model — when a call needs real judgment.
Flagged decisions land in a review queue. A reviewer's thumbs up/down becomes ground truth — promoted straight into a regression test, not just a note in a spreadsheet.
A model that passed CI on Tuesday can hallucinate, mis-call a tool, or reason its way into a bad decision on Wednesday. Reliability needs continuous monitoring and a feedback loop back into the agent — not a one-time gate.
Every decision streams to the control plane as a span in a trace, nested under a session — content-free by construction, so you see the shape of every run in production, not just the ones that got flagged.
Eval runs are recorded and diffed against each other — regressions, fixes, and still-failing cases surfaced automatically, so a prompt or policy change shows its blast radius before it ships wider.
A flagged decision doesn't just get logged — observe mode turns real traffic into a suggested policy, and a reviewed case becomes a regression test. Production keeps making the agent better, continually.
Swap Agent(…) for GovernedAgent(…). That's the integration.
Say what's allowed in plain, versioned rules — or curate them from what your fleet actually did.
Every model and tool call is authorized in-process and streamed to the control plane — content-free.
No proxy, no sidecar, no new box to run. Parapet is middleware inside your agent — pip install, wrap the agent, write a small policy. It runs in your infrastructure and fails closed.
from parapetai_agent import GovernedAgent agent = GovernedAgent( client=client, tools=[refund, delete_records, send_email], policy_dir="policies/", # plain, versioned rules ) # Every tool call + response is now authorized, # guarded, and scored — in-process, content-free. await agent.run("issue a refund for order 4471")
One-line wrap. Other frameworks plug in via OpenTelemetry.
Prove containment from your code before you ship — AutonomyProof CLI, Apache-2.0, on PyPI. No account required.
In-process and fail-closed. Deterministic Cedar policy. Nothing sensitive leaves the process.
A real customer-support agent — a genuine open-source model (Qwen2.5-3B, run locally) on the Microsoft Agent Framework — is told to wipe a customer's records. We ran it twice.
delete_records("4471")delete_records("4471") (same choice)DENY — forbidden by policy, tool name onlyThis is a real, unmocked run: real agent framework, real local open-source model, real tool execution, real Cedar decision. The model made the identical choice both times — Parapet is the only difference.100% real run
Start in CI at no cost with the open-source CLI, and upgrade to the Parapet control plane when you're running agents for real.
delete_records or send_payment) are denied in-process and never execute. Default-deny and fail-closed: if a check can't run, the action is denied.Agent(…) into GovernedAgent(…). It also ingests OpenTelemetry traces from other frameworks (LangChain/LangGraph, CrewAI, AutoGen, OpenAI Agents) so you can observe agents built anywhere while enforcing in-process where it counts. Tool calls made over MCP (Model Context Protocol) are governed the same way as native tools — each MCP action is authorized against policy before it runs.Governance that lives inside the agent — deterministic, content-free, and one line to adopt.