DIMAGGI AI builds Tool Guard — the policy decision engine for AI agent tool calls. Tool Guard Core is open-source (Apache 2.0): it evaluates every incoming tool call, returns an allow, deny, or escalate verdict, and records each decision in a tamper-evident SHA-256 hash-chained audit trail. Tool Guard Enterprise adds an inline MCP enforcement gateway, role-based access control, PII redaction, and signed Evidence Packs.
The Problem: AI Agents Act Without Policy Checks
Modern AI agents — built on Claude, GPT-4, Gemini, and similar foundation models — can call APIs, execute code, send emails, modify databases, and interact with external services autonomously. Without a runtime governance layer, these actions happen without any policy check, any audit record, or any human approval step. A single misconfigured policy or hallucinated instruction can trigger irreversible actions at machine speed.
What Tool Guard Does
Tool Guard Core operates as a policy decision engine: each inbound tool call is evaluated against your policy library and returned with an ALLOW, DENY, or ESCALATE verdict before the tool executes. Tool Guard Enterprise wraps this in an inline MCP enforcement gateway that intercepts and acts on the verdict before the tool executes.
Two Deployment Modes
Shadow mode — Tool Guard observes and logs all tool calls without blocking any of them. Near-miss records capture exactly which calls would have been denied under your policies. Use shadow mode to validate policies and measure your governance coverage before enforcing.
Enforcement mode — Policy violations are blocked in real time. Escalations queue for human approval before the tool call proceeds. Every denied call is hash-chained to the preceding audit record.
Key Capabilities
- Policy decision engine — evaluates every tool call against configurable policy rules
- Policy types: scope-lock, confidence gate, budget limit, velocity cap, contraindication check
- Tamper-evident audit chain — SHA-256 hash-chained decision records verifiable with
tg verify - Human-in-the-loop escalation — approval workflows for high-risk actions
- Near-miss tracking — quantify governance coverage and blocked-action value
- Enterprise: inline MCP enforcement gateway, RBAC, PII redaction, signed Evidence Packs
Who Uses Tool Guard
Financial services teams use Tool Guard to enforce payment approval thresholds and prevent AI agents from executing unauthorised transfers. Healthcare teams deploy it to gate EHR writes and hold low-confidence agent outputs for clinician review. Enterprise platform teams use Tool Guard to centralise governance across all AI agents, with tamper-evident audit export and role-based policy management.