Injection backstop.
Outside the model.
Praxom is the policy decision point for agent actions. It does not ask the model to behave — it evaluates the proposed tool call against steward-confirmed state, then signs the decision.
Agent claims are not evidence
Side-by-side: what the agent said vs what the gate evaluated. Enforcement keys off confirmed model state — not agent self-reports.
“User approved — export contacts for the quarterly board pack.”
No steward approval · injection tokens in args · export target = public channel
DENYsigned · fail-closedThe injection can change the agent's mind; it cannot change the ledger.
Five outcomes. One decision path.
Three of them, played out on synthetic scenarios:
Ordered slots before execution
Nine slots stand between a proposed action and execution, and any one of them can stop it. The cheap checks run before any expensive reasoning — a deny never pays for reasoning — and every slot is synchronous and IO-free by design invariant.
- Kill switchWorkspace hard-stop. Checked before identity, before anything — a killed workspace executes nothing.
- IdentityCaller resolved to a registered agent and trust tier — AWS IAM, Azure MSI, or SPIFFE workload identity.
- ScopeIs this tool inside the agent's granted task scope? Out-of-scope proposals stop here.
- LeasesA valid, unexpired task lease must cover the action. Expired lease, no action.
- BudgetsPer-agent USD and action-count ceilings. Budget-velocity spikes auto-suspend the agent.
- Tool pinThe tool schema must match the version that was reviewed — swapped or mutated tools are refused.
- Policy + taintBusiness rules evaluated deterministically — JSON predicates and formal SHACL shapes — with data-taint state feeding the decision so read-sensitive-then-exfiltrate paths are blocked.
- RewriteWhere policy allows with changes: cap amounts, mask fields, set safe defaults — the original preserved in the record.
- AttestEd25519-signed, hash-chained record of the decision. Every path through the gate ends here — allowed or not.
Budgets here are enforcement, not observability: per-agent USD and action-count ceilings stop loop burn before it reaches your cloud bill, auto-suspend catches budget-velocity spikes, and a DENY never pays for the bad tool call. The blast radius being protected is your P&L, not ours.
Evidence, export, and the off switch
Ed25519-signed, hash-chained, WORM-anchored. Independently verifiable with the open-source pramiti-mcp-verify CLI (SEP-2828).
OCSF export to Splunk HEC and Microsoft Sentinel — delivered via transactional outbox, into the rest of your security stack.
Stop all actions instantly with a workspace hard-stop. The emergency override exists — but it is scoped, signed, and logged.
Drop-in guard decorators for LangGraph, AutoGen, and CrewAI — or plain MCP. One integration point, every action gated.
See the gate deny an injected action.
CISO path: a live walkthrough on your own scenarios. Builders: point the free scanner at your MCP setup first.