Guardrails scan text. Agents take actions. SHAI governs what they do.

Every entry point is scanned before content reaches the LLM.

Injection, jailbreak, and identity-spoof catalogs run at the user input, file, and tool-result boundaries, each merged with its French, Spanish, German, and Mandarin variants. A cross-turn accumulator catches escalation spread across turns that each stay under the per-turn threshold.

Seven-layer gate on every tool call, no exceptions.

Operator's config draws that line action by action, so one agent can be cleared to read a customer record and refused the ability to change it. Every LLM-proposed tool call goes through the gate, which checks it against the list of allowed actions. Deterministic, not heuristic.

A subagent holds at most what its parent granted.

This is the most consistently reported failure in enterprise agent deployments: shared API keys, inherited user sessions, overpermissioned service accounts, and an agent that can reach systems its function never needed. Tools and capability tags must be a subset of the parent's, refused at load if they aren't, and re-checked by the gate on every call. Only agents registered with SHAI can call tools. Credentials stay behind secret:// URIs, resolved at load and never written into config.

An MCP source is built only when its manifest hash matches an approved baseline.

The GitHub MCP exploit and the Amazon Q compromise, which reached a coding assistant with more than 950,000 installs, both arrived through something the agent depended on rather than something a user typed. The baseline is re-checked when the source connects and again on every tool call, so an edited manifest is refused at both. Tool names, descriptions, and tags come from the approved manifest rather than the remote server's own listing, and are scanned for injected instructions. Pattern updates are HMAC-signed and verified row by row before they apply.

Dangerous command composition is caught at any boundary.

A code-execution agent carries the maximum exposure here. A command can be written to look like ordinary text. It arrives in a message someone types, a file they upload, or the reply a tool sends back. Hand it to the system and it executes with every permission the agent holds. SHAI checks each of those, plus the arguments the agent passes to a tool and the text it sends back out. Sandboxing what already runs belongs to your runtime.

Everything that reaches memory has crossed a SHAI boundary.

Anything an agent reads is potentially adversarial, including its own memory, so a poisoned document or retrieval record can shape a decision several runs after it lands. A webpage the agent browses or an email it reads can carry instructions dressed as ordinary content. So user input, uploads, and retrieval results are all scanned before the LLM ingests them. Anything the agent then writes to memory is itself a tool call, so it passes the gate like any other action.

SHAI governs the boundaries around a single agent. The channel between two agents sits outside it.

It has no transport of its own between agents and does not authenticate peers. Compose with a message layer that does.

Failures stop at the boundary.

One agent's error or compromise fans out through the agents that depend on it, so a fault that would stay contained in a single service amplifies across the chain. Scanner errors fail closed by default, so an outage blocks rather than passing content through unchecked. Sliding-window rate limits run per agent and per tool, session budgets cap steps and fan-out, and fingerprint-based loop detection catches an agent repeating near-identical calls. A persistent kill switch revokes one agent while the others keep running, and the revocation survives a restart. Budgets are held per SHAI instance.

SHAI evaluates the action proposed, not how persuasive the agent was on the way there.

This is a human-factors and interface problem. The approval quorum below raises the cost of a single manipulated approver without detecting the manipulation itself.

A rogue agent is still bound by its config, and it can be killed.

Replit's agent deleting a production database during a code freeze is the reference case: an agent operating outside policy through drift rather than through a break-in. Only registered agents can call tools, and every call is gated against the operator's config regardless of what the model intends. Revocation denies at the pre-gate within one cache TTL and persists across restarts. A consolidated turn-risk score blocks turns whose combined signals cross the high threshold, catching attacks that stayed below every individual scanner's threshold.

Every allowed call carries a signed, single-use token bound to that one decision.

The token names the tool, agent, and source, and expires in seconds. ShaiTransport checks it on every MCP request; a local tool checks it with verify_tool_dispatch inside dispatch_scope. Untokened requests are refused by default. Stop issuing tokens and that agent's outbound traffic stops within one TTL, without needing the agent loop's cooperation.

Sensitive and irreversible tools need a quorum of signed approvals.

Each grant is bound to one agent, tenant, tool, argument digest, approver, and expiry, then verified offline against an HMAC secret. SHAI checks a signature and never calls an authorization server. An empty secret denies every such tool rather than falling back to permissive, and grants do not propagate to subagents.

Every boundary leaves exactly one structured, signed audit event.

One event per call on every code path, including failures. No raw user text, model output, arguments, or matched substrings appear in any field. HMAC-SHA256 signed, JSONL for SIEM ingestion, tenant stamped from config rather than from the caller. The gate decision, the token check, and the result scan all join on one token_id.

PII and secrets are scanned at input, output, file content, and tool arguments.

Cards are Luhn-validated and SSNs structure-validated to hold false positives down, and coverage reaches private keys, JWTs, AWS secrets, connection strings, and webhook URLs. Each boundary can block, alert, or redact in place, replacing the matched fragment while the rest passes through.

Rate limits, session budgets, and loop detection on every tool call.

Sliding-window rate limits per agent and per tool, cumulative session budgets, and fingerprint-based loop detection keep runaway loops from doing real damage. Enforced per SHAI instance; distributed deployments use the shared-state backend.