You can tell an AI agent to stay under its budget and only use approved vendors, and most of the time it will. But "most of the time" is not a control you can show an auditor. An agent that can be talked out of a rule was never really bound by it; it was only asked.
That gap is why we built MetaMynd AgentSafe Guard. Instead of hoping the agent behaves, the guard moves the decision somewhere the agent doesn't control. You wrap a tool once, without touching your prompts or the tool itself, and from then on that tool only runs when an authorization gate says yes. Each call is checked against a mandate that someone issued on purpose, signed, and decided before your code runs. If the answer is no, the call never executes.
The part we care about most isn't the spend cap, which anyone could write. It's that an agent cannot widen its own authority. The gate denies by default, so when an agent asks for something nobody delegated to it, like raising its own limit, it's refused at $1 and at $100,000 alike. No special rule is needed to stop self-escalation; it falls out of the design.
The guard isn't tied to any one agent framework, because it wraps the tool function itself. It works with JavaScript and TypeScript agents on Node.js, with Python agents through the MetaMynd reference client, inside MCP servers so even a compromised agent can't make an honest service act, between agents over Agent2Agent, and in front of ordinary HTTP APIs. None of the guards pulls in a single runtime dependency, which matters for code that sits in the path of every privileged action.
At its heart is a small, deterministic evaluator with no network, no clock and no LLM: the same inputs always give the same verdict, and the code is open for anyone to check. Blocks and escalations are decided right in your process. Only a permitted action that moves money goes out to the gate to be sealed.
The repository is the client half; the gate itself is a hosted service at metamynd.ai. If the gate can't be reached, the guard fails closed and blocks value-bearing actions rather than letting them through, and there's no self-hosted gate yet.
The quickest way to see it is the sandbox: one command, no account, and in about a minute you'll watch an agent get allowed, blocked, held for a human, and refused when it tries to raise its own limit.
Try it out now!
