enforce
Rewrite, don’t validate
Policy is compiled directly into each query. After the rewrite, arbitrarily clever SQL — joins, windows, CTEs — cannot see past the fence, because the fence is part of the query.
Agent Flight Control gives every AI agent its own policy and compiles that policy directly into what the agent does — rewriting its SQL before a database runs it, and its tool calls before an MCP server sees them. Governance stays deterministic and changes only through your approval process, and a complete audit trail preserves what each agent did and why.
Policy is compiled directly into each query. After the rewrite, arbitrarily clever SQL — joins, windows, CTEs — cannot see past the fence, because the fence is part of the query.
One policy language for sources, tables, columns, and rows. An empty policy grants nothing; every grant is explicit.
Row filters confine every result to the agent’s slice — one tenant, one region. Sensitive columns come back masked without changing the query the agent wrote.
INSERT, UPDATE, and DELETE run under the same scope: a write that would move a row outside the agent’s slice is rejected, and nothing changes.
A Postgres wire listener, native MCP tools, and REST — psql, drivers, and agent frameworks connect with zero custom integration. Same enforcement on every path.
Every statement — allowed or denied — lands in a durable audit trail with what was rewritten, masked, or clamped, and per-agent egress budgets cap how much any key can pull. That same trail feeds a shared reasoning layer: agents learn from each other’s audited runs and get sharper at judgment calls over time — policy enforcement itself never changes without going through your own approval process.
Agents don’t only query databases. They open pull requests, post to Slack, file tickets, page on‑call, update customer records and drive browsers — and every one of those is an MCP tool call. The firewall sits between your agents and the MCP servers you already run: the servers stay exactly as deployed, the agent’s config changes one URL, and every message crosses the policy in both directions.
Each key can carry its own upstream OAuth token, so an action in GitHub or Salesforce is attributed to a person rather than to one shared service account. A key that hasn’t connected sends nothing instead of borrowing someone else’s access.
A policy can pin an argument: every ticket carries your project, every message your channel prefix. An agent that supplies a different value is denied rather than quietly fixed, so a bad call is visible instead of laundered.
Flow rules taint a session: once an agent has fetched untrusted content, the tools that could exfiltrate it disappear for the rest of that session. The classic prompt‑injection chain is closed structurally, not detected after the fact.
Twelve validated detectors — AWS keys, GitHub and Slack tokens, Stripe keys, private keys, card numbers, IBANs — are checked rather than pattern‑guessed, and stripped span‑exactly so the surrounding text survives.
Tool descriptions and schemas are hashed on first sight; drift suspends the tool until a human re‑approves it, and reverting the change does not un‑suspend it. A tool that merely appears after approval is suspended too.
Where a tool takes SQL — a database MCP’s query field — the same per‑dialect rewriter from the SQL door runs inside the string, applying row filters and relation allow‑lists. The fence follows the query wherever it is carried.