AppsAI Agent Firewall

Policy and operations

Monitor and Enforce

Every Autessa firewall policy has a mode: Monitor records what each check would do without changing anything your customers see, and Enforce applies the actions. Each agent uses the company policy, its own custom policy, or no firewall.

Turn on the firewall
ALLOWNothing found. The turn goes ahead.
FLAGThe turn goes ahead and an alert is recorded.
CHALLENGEBefore the next sensitive tool, the person verifies.
REQUIRE_APPROVALThe tool call waits for an admin to approve or reject it.
BLOCKThe tool doesn’t run; the agent says it can’t help with that.

When several checks fire on one turn, the strongest action wins.

The problem

Security tools that block on day one break real conversations and get turned off. You need to see what a guardrail would do on your own traffic before you trust it.

How monitor and enforce works

STEP 1

Start in Monitor

Turn on checks and set actions. Monitor is the default; everything is recorded, nothing is stopped.

STEP 2

Watch for a week or two

Read the alerts and dashboard. Adjust thresholds and actions where you see false alarms.

STEP 3

Tune per agent

Give a payroll agent a stricter custom policy, or turn the firewall off for an internal sandbox.

STEP 4

Switch to Enforce

Actions now apply: block, ask to verify or hold for approval.

Every setting

Mode

Monitor (default) or Enforce. Also settable from the CLI: autessa agent-firewall policy MONITOR.

Agent setting

Use company policy (default), Custom, or Off.

When a check can’t run

Per check: Let it through (default) or Stop it.

Coverage

Builder, apps and websites, embedded chat, SMS, phone, Slack, the Client API, triggers and scripts, and multi-agent managers.

Who can do what

Admins who manage team members

Change the mode and policies.

Agent owners

Choose an agent’s setting on its AI Application Firewall card.

What to know

  • Verify before use on a tool is always enforced, even in Monitor or with the agent’s firewall Off.
  • Copying an agent or installing a shared one keeps its firewall setting.

More in Policy and operations

Custom rules and exceptions →Ordered rules add an action and exceptions remove findings, using conditions on channel, tool, identity, voice score, country, time and text, previewed against the last 7 days.Alerts and approvals →Every decision lands on a sortable alerts page with the score, cues and a link to the conversation; held tool calls get Approve and Reject, also from the admin’s inbox.Monitoring dashboard →One dashboard shows checks, catches, blocks, verifications and points for every agent and API policy, with trends, what was caught, top rules and top identities.Attack simulator →A dry-run red team: built-in prompt injection, pressure, passphrase guessing, word replay, anomaly, exfiltration and cloned-voice attacks against an agent, with a scorecard of what got through.All of Policy and operations →

FAQ

Monitor and Enforce: questions

Can I test AI guardrails without affecting customers?

Yes. Monitor mode records every decision on the alerts page without changing anything customers see.

Can different agents have different policies?

Yes. Each agent uses the company policy, a custom policy of its own, or none.

Turn on monitor and enforce.

Monitor records what every check would do without changing what customers see; Enforce applies the actions. Each agent uses the company policy, its own custom policy, or none. Start in Monitor and see what it would catch on your real traffic.

Turn on the firewall

Starts in Monitor · nothing changes for your customers until you enforce

100% customizable, code and all

Make Autessa AI Agent Firewall fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours