---
title: "AI agent governance · control plane, guardrails, sandboxes, policy engines · Agent Fieldbook"
url: https://agentfieldbook.org/security/governance/
description: "How AI agents are governed at runtime. The agent control plane laid out layer by layer: runtime firewall, vendor-native guardrails, model-and-tool-call gateway, pre-action authorization, policy engine and sandbox. A source-graded field book to the vendors securing the agents themselves, grouped by which layer of the stack they occupy."
section: "Security · Governance"
source: Agent Fieldbook — generated from the published page
---

# The agent control plane

Agency cuts both ways: a new layer secures the agents themselves: sandboxes, policy engines, gateways, guardrails and pre-action authorization between an agent and your infrastructure. Grouped by **control-plane layer**, top-to-bottom: firewall → guardrails → gateway → authz → policy → sandbox.

## Runtime AI firewall · 3

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **Prompt Security** | Prompt Security | Prompt-injection + data exfiltration at runtime | confirmed | [↗](https://generalanalysis.com/guides/best-ai-security-platforms) |
| **Lakera Guard** | Lakera | Prompt-injection, data leakage, PII exfiltration and hallucination detection at runtime: widely-used commercial AI firewall. | confirmed | [↗](https://www.lakera.ai/lakera-guard) |
| **Prompt Guard (Meta Llama Guard)** | Meta | Open-source classifier for prompt-injection and jailbreak detection: the reference OSS AI firewall, deployable in-line before any LLM call. | confirmed | [↗](https://ai.meta.com/blog/prompt-guard/) |

## AI posture + runtime controls · 1

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **Cisco AI Defense** | Cisco | Enterprise AI inventory, posture and runtime controls | confirmed | [↗](https://generalanalysis.com/guides/best-ai-security-platforms) |

## Vendor-native guardrails · 3

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **AWS Bedrock Guardrails** | Amazon Web Services | Bedrock agents, vendor-side guardrails for content filtering, PII redaction, denied topics, sensitive-info policies. Applied to model + agent tool calls at the platform. | confirmed | [↗](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html) |
| **Azure AI Content Safety** | Microsoft | Azure OpenAI + Foundry agents, vendor-side content moderation (harm categories), prompt shields (jailbreak + indirect injection), groundedness detection. | confirmed | [↗](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/overview) |
| **Vertex AI Safety Filters** | Google | Vertex Agent Builder + Gemini agents, configurable safety filters (harassment, hate, sexual, dangerous), citation checks, and safety attributes. | confirmed | [↗](https://cloud.google.com/vertex-ai/generative-ai/docs/multimodal/configure-safety-attributes) |

## Gateway (model + tool call) · 3

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **TrueFoundry AI/MCP Gateway** | TrueFoundry | Model + MCP tool calls, RBAC, guardrails, budget controls, full OTEL export | confirmed | [↗](https://www.truefoundry.com/blog/enterprise-ai-agent-security-solutions) |
| **Portkey AI Gateway** | Portkey | Multi-provider LLM gateway with observability, cost controls, guardrails, PII redaction, semantic caching. Used by agent teams to route + govern hundreds of models behind a single endpoint. | confirmed | [↗](https://portkey.ai/docs) |
| **Kong AI Gateway** | Kong | Enterprise API gateway extended for LLM traffic: auth, rate-limits, semantic firewalls, prompt templates, response transformers applied per-provider. | confirmed | [↗](https://konghq.com/products/kong-ai-gateway) |

## Pre-action authorization · 1

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **Aport** | Aport | Agent actions, pre-action authz gate (approve/deny before the agent acts) | confirmed | [↗](https://aport.io/blog/best-ai-agent-guardrails-2026-pre-action-authorization-compared/) |

## Policy engine · 1

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **Open Policy Agent (OPA)** | CNCF (Styra) | Any agent action, Rego policies evaluate the proposed call before it fires. The de-facto CNCF policy engine, widely adopted for k8s + microservices; agents plug in via sidecar or in-process. | confirmed | [↗](https://www.openpolicyagent.org/) |

## Sandbox + policy engine · 1

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **OpenShell** | NVIDIA (Agent Toolkit) | Any agent, purpose-built sandbox, YAML policy on filesystem/network/process, controls where inference travels | confirmed | [↗](https://futurumgroup.com/insights/openshell-redraws-the-agent-control-plane-open-standard-or-product-launch/) |

## Governance runtime · 1

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **NVIDIA NemoClaw** | NVIDIA | OpenClaw agents, OpenShell sandbox + Policy Engine (filesystem/network/process) + Privacy Router; runs Nemotron locally for sensitive workloads | confirmed | [↗](https://nemoclaw.run) |

## Cloud agent sandbox · 3

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **E2B** | E2B | Agent code execution, market-leading isolated cloud sandboxes (Manus 27 tools, Perplexity, Hugging Face) | confirmed | [↗](https://e2b.dev) |
| **Modal Sandboxes** | Modal | Agent code execution, programmatic sandboxes with per-run isolation, GPU support, filesystem/network policies. Popular for coding-agent workloads (Devin-class). | confirmed | [↗](https://modal.com/docs/guide/sandbox) |
| **Daytona** | Daytona | Agent dev + code-exec environments, ephemeral sandbox workspaces with git integration, used by coding agents for isolated build/test/PR cycles. | confirmed | [↗](https://www.daytona.io/) |

## Enterprise sandbox · 1

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **Alibaba OpenSandbox** | Alibaba | Agent execution, enterprise Docker/K8s sandbox runtimes | research | [↗](https://generalanalysis.com/guides/best-ai-security-platforms) |

## Governed data + action authority · 1

| Name | Vendor | Secures | Conf. | src |
| --- | --- | --- | --- | --- |
| **Palantir Ontology· Action Types + governance** | Palantir Technologies | Agents execute predefined Action Types (e.g. order inventory, approve schedule) with the same security and compliance guardrails a human user has. Deterministic tools (mathematical, simulation, optimisation algorithms) wire in as verifiable steps that complement probabilistic LLM reasoning. Ontology MCP extends the same guardrails to external frameworks. | confirmed | [↗](https://palantir.com/docs/foundry/ontology/overview/) |

## Field notes

Firewall, guardrails, gateway, authz, policy, sandbox: the stack that governs the agent

Accountability cannot be delegated to a model. Every deployed agent needs a named human owner, and the controls that hold up are the deterministic ones, sandboxes and gates, rather than instructions in a prompt asking the agent to behave.

None of these layers trusts the model to restrain itself. The model proposes; the control plane disposes. That is why the strongest pattern across the whole security section is the same one that shows up in the incident log: never expose raw secrets or unbounded permissions to the model, and cap the blast radius in the deterministic path instead of trusting a per-call approval the model can talk its way around. Every vendor below is grouped by which layer of that stack it occupies, and each row is sourced.

- [Brandon Chaplin](https://www.linkedin.com/in/brandon-chaplin-digital-marketing-strategist)

## Common questions

### How do you control what an AI agent is allowed to do?

With controls outside the model, not instructions inside it. The usual stack is a runtime firewall, guardrails near the model, a gateway every model and tool call passes through, a permission check before an action fires, a policy engine and a sandbox around the whole thing. Each layer shrinks what a bad action can reach.

### What is an AI guardrail?

A guardrail is a filter on what goes into or comes out of the model: blocking injection attempts, harmful content, or data that should not leave. Most model vendors ship their own. OWASP ranks prompt injection as the top risk for LLM applications, and that is largely what guardrails are trying to catch [(OWASP)](https://owasp.org/www-project-top-10-for-large-language-model-applications/).

### What is an AI gateway?

A single point that every model and tool call passes through, where it can be logged, rate-limited, filtered and checked against policy. It gives you one place to see and control traffic instead of each integration enforcing its own rules. It is also where you swap models without rewriting the agent.

### What is an agent sandbox?

An isolated environment, with its own filesystem, network and process limits, that the agent runs inside so a compromised run cannot reach the wider system. It caps what code execution, file access and tool use can touch. It is the last line when everything earlier has failed.

### Can you just tell an agent in its prompt not to do something?

Not reliably. A prompt instruction is a request, and prompt injection works precisely by getting the model to follow different instructions instead. The controls that hold are deterministic: a permission check in code, a sandbox boundary, a gate the model cannot argue past. The NIST AI Risk Management Framework treats this as governance you build around the system, not a property of the model [(NIST)](https://www.nist.gov/itl/ai-risk-management-framework).

## Next in the learning path

- [Human oversight The approval gate the control plane enforces](https://agentfieldbook.org/security/oversight/)

- [Auth & secrets How the agent holds credentials safely](https://agentfieldbook.org/security/auth/)

- [Incident log The failures this control plane exists to stop](https://agentfieldbook.org/security/incidents/)

- [Shadow AI The ungoverned surface governance answers](https://agentfieldbook.org/security/shadow_ai/)