AgentGuard: Real-Time Policy and Budget Enforcement for LLM Agent Pipelines

The per-call budget axis is the underrated part of this - we run LLM agent pipelines in production and our worst incident wasn't a malicious write, it was a pathological input looping "safe" reads until the job cost \~20x its estimate. A gateway that treats spend as a first-class policy dimension catches a whole class of failures that read/write taxonomies miss. Bonus we discovered: jobs that hit the budget ceiling are almost always broken in some other way too, so the cost guard doubles as a bug detector. Threat-model feedback you asked for: behavior-spike detection will catch a hijacked client acting weird, but the nastier case is prompt injection that keeps the client perfectly in-profile - normal-looking reads whose CONTENT steers the next calls. Two things that would strengthen the story: (1) provenance tagging on reads (mark tool results as untrusted input, so policies can require approval when a write follows a tainted read), and (2) post-condition audit fields - record what state the call claimed to change and let a verifier diff it, because logs happily record writes that silently no-opped. Also +1 for one Go binary - the ops story is half the adoption battle for this category.

The per-call budget axis is the underrated part of this - we run LLM agent pipelines in production and our worst incident wasn't a malicious write, it was a pathological input looping "safe" reads until the job cost \~20x its estimate. A gateway that treats spend as a first-class policy dimension catches a whole class of failures that read/write taxonomies miss. Bonus we discovered: jobs that hit the budget ceiling are almost always broken in some other way too, so the cost guard doubles as a bug detector. Threat-model feedback you asked for: behavior-spike detection will catch a hijacked client acting weird, but the nastier case is prompt injection that keeps the client perfectly in-profile - normal-looking reads whose CONTENT steers the next calls. Two things that would strengthen the story: (1) provenance tagging on reads (mark tool results as untrusted input, so policies can require approval when a write follows a tainted read), and (2) post-condition audit fields - record what state the call claimed to change and let a verifier diff it, because logs happily record writes that silently no-opped. Also +1 for one Go binary - the ops story is half the adoption battle for this category.