Generative AI Agent Guardrails

What a control plane for AI agents must do

“Control plane” is a role, not a marketing label. Any system that claims it has to actually do four things, in order, every time an agent tries to act.

Policy: declarative, versioned rules

Policy has to be explicit and inspectable, not a paragraph buried in a system prompt. SigmaShake’s .rules DSL is plain text: IF/THEN conditions built from operators like CONTAINS, GLOB, and REGEX, checked into git alongside your code, reviewed in pull requests, and shared across a team the same way any other config is.

Enforcement before execution: deterministic, no LLM in the loop

Enforcement has to happen before the action runs, and it has to be deterministic. SigmaShake’s rule engine is a native evaluator, not a second model call: a typical decision lands in under 2ms, with no LLM in the loop and no risk of the enforcement layer itself hallucinating an exception.

Human-in-the-loop: ASK approvals

Not every action is a clean allow or deny. For the dual-use middle, SigmaShake’s ASK verdict pauses the tool call and routes it to a human for approval through the dashboard, so judgment calls stay with a person instead of defaulting open.

Audit: every decision logged

Every decision, ALLOW, DENY, ASK, or FORCE, is written to a local, signed audit log, so you can answer what an agent tried to do and when. ssg serve gives a real-time dashboard for approvals; for teams, fleet-wide policy sync and centralized audit export cover multiple machines from one place.

Where SigmaShake sits vs enterprise agent control planes

“Control plane” is also the term enterprise platforms use for a different layer. Microsoft’s Agent 365 and Fiddler’s platform both describe themselves as control planes for AI agents at the organization level, covering agent identity, deployment, and fleet-wide observability across a company’s whole agent estate. Those are the kinds of problems an organization-level control plane says it addresses, distinct from what runs on any one developer machine.

SigmaShake solves a narrower, local problem: what a single agent’s tool call is allowed to do, right now, on the machine where it is actually running. It is the local, runtime, tool-call control plane for coding agents, not an identity or deployment platform, and it is complementary to an enterprise agent control plane, not a replacement for one. A team can run an enterprise control plane for fleet-wide identity and observability, and run SigmaShake underneath it on every developer machine and CI runner to gate the actual tool calls.

SigmaShake vs nah vs LLM I/O filters

nah is the closest thing to a direct peer: an open-source, deterministic tool-call guard (MIT license, no pricing page found) with no LLM in the loop, shipped as a single static Rust binary with 19 built-in guards. Credit where it’s due: open source, one binary, and broad agent support are all genuinely good defaults. The honest differences are policy authorship, verdict range, and what happens after a decision is made.

Scroll right for more columns →

Neither SigmaShake nor nah is the same layer as an LLM I/O filter (LLM Guard, NeMo Guardrails, Guardrails AI): those tools inspect a model’s text prompt or response, not the tool call it is about to make. See the full comparison against LLM I/O filters and built-in agent sandboxes for that layer.

Sources: nahguard.ai and github.com/manuelschipper/nah, verified 2026-08-26. nah evolves quickly, so verify current capabilities before you decide.

FAQ

What’s the difference between a control plane and “guardrails”?

“Guardrails” describes the behavior; “control plane” describes the architectural role: the layer that decides what an agent is allowed to do, separate from the agent itself. SigmaShake’s guardrails are the policy engine that plays the control-plane role at the tool-call boundary.

Does it need an LLM to make a decision?

No. Every rule evaluation runs through a deterministic, native engine — no model call, no LLM in the loop. That keeps decisions fast (sub-2ms) and reproducible: the same tool call against the same rules always returns the same verdict.

Which agents does it work with?

Claude Code, Cursor, Codex, VS Code Copilot, Antigravity, Grok, Replit, OpenCode, Aider, Pi, and any MCP-compatible client, through native hooks or SigmaShake’s own MCP server.

Is it free?

SigmaShake is free to download and install. $5/month unlocks every value surface: unlimited rule evaluation and everything beyond it. There is no free tier of the value itself and no anonymous path to it, by design.

How is this different from nah?

nah is an open-source, single-binary guard (MIT license) with 19 built-in guards; it describes itself as “a guard that blocks catastrophic agent actions.” SigmaShake is a paid, user-authored policy engine with a wider verdict set (including ASK approvals), an audit dashboard, and fleet management for teams. See the comparison table above.

Read more on AI agent security, MCP tool-call security, and the case files behind this policy model: how a sandbox held but per-tool-call governance was still the missing layer, why MCP servers need the same tool-call governance as native commands, and why the Y/N approval prompt does not scale.