Your agent is about
to drop the database.
Invarix.Gate reads every tool call before it runs and stops the ones that cannot be undone. Deterministic rules, no second model in the loop, and a first run that changes nothing so you can see what it would have caught before you let it catch anything.
Rules drawn from
incidents that happened.
Of 344 verified enterprise AI incidents, 188 involved an agent causing production harm with no attacker anywhere in the chain. Nothing was breached. Something was simply allowed to run. Below are the six shapes that keep recurring. Four more ship with them: mass sends, tools outside an agent's declared allowlist, spend ceilings, and a rule that stops an agent editing Gate's own policy, which is the one with no public incident behind it yet. The everyday commands that resemble all of these are tested just as hard, because a rule that fires on ordinary work is a rule somebody switches off.
Destructive SQL
DROP, TRUNCATE, and DELETE or UPDATE with no WHERE clause. A lexer strips string literals and comments first, so a DROP quoted inside a value cannot trip it and a scoped delete never does. Replit's agent wiped SaaStr's production database during a code freeze in July 2025.
Shell and file destruction
rm -rf outside the workspace, del /s, Remove-Item -Recurse -Force, mass deletes. Compound commands split on every separator, so a destructive tail after a harmless head still fires. The compromised Amazon Q extension shipped a wiper prompt that only a syntax error stopped.
Git history destruction
Force pushes, branch deletes, and filter-branch on the branches you protect. A force push to the agent's own feature branch is a routine rebase and stays quiet, because a rule that blocks that gets uninstalled the same afternoon.
Cloud teardown
delete-stack, terminate-instances, terraform destroy, namespace deletes, across the AWS, Azure, and GCP spellings including the s3api forms. kubectl delete pod never fires: it is self-healing, and it is the canonical false positive.
Credential egress
Access keys, tokens, private keys, JWTs, and connection strings heading out of the building. Scoped to outbound tools only, so writing a key to a local file is not the same event as posting it. The one rule that blocks outright rather than asking.
Runaway loops and ceilings
Exact repetition, retry-with-jitter, and A-B-A-B ping-pong between agents, plus call and token ceilings per run and per agent. Two LangChain agents looped for eleven days and burned $47,000 in November 2025. Breaching a ceiling ends the run, because denying one call just makes the loop retry it.
using Invarix.Gate;
using Invarix.Gate.Extensions.AI;
// Observe mode is the default. Nothing is blocked, everything is reported.
var gate = GateEngine.Create(GateOptions.FromYaml("gate-policy.yaml"));
// Any Microsoft.Extensions.AI pipeline. MCP tools are covered here too,
// because an MCP client tool is an ordinary AIFunction.
var client = inner.AsBuilder()
.UseInvarixGate(gate, agentId: "checkout-bot")
.Build();It reports first.
You decide when it acts.
A safety tool you cannot try in production is a safety tool nobody installs. Observe mode is the default and it blocks nothing, so the first thing Gate gives you is an honest account of what your agent has been doing.
── Invarix.Gate ── observe mode ── run 018f3c… ── agent release-agent ──
15 tool calls evaluated · 0 blocked (observe mode never blocks)
In enforce mode, this run would have seen:
IRREVERSIBLE (would require approval) 3 calls
destructive-sql db_execute DELETE without WHERE in statement 1
git-history run_command force push rewrites protected 'main'
scope-allowlist publish_release not in the allowlist for this agent
HIGH-CONFIDENCE (would block) 1 call
secret-egress http_post AWS access key id in outbound body
CUMULATIVE (would warn / terminate)
runaway-loops poll_job_status called 6 times, identical arguments
limits.calls 15 / 300 tool calls (5%)
COVERAGE (within the wrapped pipeline)
7 tools registered · 7 routed through Gate · 0 calls executed outside
Flip to enforce: set `mode: enforce` in gate-policy.yaml- allowRun it. Almost everything, almost always.
- warnRun it, and put it in the report.
- approveHold it until a human answers.
- denyRefuse it, and tell the model why so it can adapt.
- terminateRefuse it and end the run.
The most severe verdict across every matching rule wins, and there is no way to write a broad allow that quietly swallows a narrow deny. Terminate is not something a policy can assign: it is what the engine does when a loop or a ceiling breaks, because refusing one call in a loop just makes the loop try again.
- 1
Install and wire one line
One package and one builder call on the chat client or the agent. Nothing else in your host changes, and no traffic leaves the process.
- 2
Run your agent as usual
Observe mode evaluates every tool call and intervenes in nothing at all, including runaway loops. There is no mode where installing this breaks a working agent.
- 3
Read what it would have stopped
The report groups findings the way the decision is actually made: irreversible, high confidence, and cumulative. It also names what it could not see, and suggests the exact policy lines to paste.
- 4
Flip one line
mode: enforce. The same rules that reported now refuse: denied with an explanation the model can read, paused for a human, or the run ended when a ceiling breaks.
What it costs.
Observing is free and stays free. Enforcing is one payment for the company, not a subscription that has to be defended at every renewal.
Community
Free foreverObserve mode and the whole detector pack. It evaluates every tool call, reports what enforce would have stopped, and blocks nothing. Useful on its own: most teams have never seen a list of what their agent actually touches.
- All ten detectors, at their tuned defaults
- The run report, on the console or as markdown
- The verdict log, one JSON object per decision
- Coverage reporting, including what Gate could not see
- Policy in readable YAML or fluent C#
- Adapters for Microsoft.Extensions.AI and Agent Framework
- MCP client tools covered through the same interception
Professional
LifetimeEverything above, plus the modes that actually stop things: enforcement, human approval, and evidence. No subscription, no seat counting, no renewal to forget.
- Enforce mode: deny, escalate, and end a runaway run
- Human approval over a webhook, with single-use links
- Tamper-evident evidence records via Invarix.Guard.Evidence
- Every future version, at no further cost
- Non-transferable on acquisition
- No support of any kind, no SLA. The docs ship in the package
Pair it with Invarix.Guard
Gate is an action firewall: it decides what an agent may do. Guard is a content firewall: it screens what goes into the model and comes back out. Different questions, same process, no overlap.
- Prompt injection, PII, and toxicity scanning in process
- 19 harm categories, scored by a multilingual embedding model
- Runs on the request; Gate runs on the tool call
- Hot reloadable custom blocklist (Professional)