Blog
Notes on I/O Mesh: where a check sits before a tool runs, how a failure becomes a deny, how usage stays on your network, and how to check a signed audit heartbeat.
The guardrails you clean up and the check you keep
Models absorb the harness tricks that taught them to code. Trust and security stay behind. Here is why we keep that check in a separate decision service.
Decide before the tool runs: where an allow/deny check belongs in an agent harness
You already have an agent harness. It takes a model's proposed tool call, parses the arguments, and runs the tool. Somewhere in that loop there is probably a check. Maybe it lives in a prompt. Maybe it is an if statement someone added after an incident. Maybe it is a log line written after the tool has already returned.
Fail closed: every way an agent policy check should say no
An agent policy check sits in the path of every tool call. When it breaks, it has to pick a side. Fail open and the agent keeps working with no check. Fail closed and the agent stops.
Self-hosted means no phone-home: how usage counting works without sending data
Procurement asks the same question about every self-hosted product: "What does it send back to the vendor?" Often the honest answer is "usage telemetry, for billing." That means data about your agents leaving your network on a schedule you did not set.
What a signed audit heartbeat is, and how to check one
When a team hands you an audit log, you usually get a CSV export or read access to a logging tool. You then have to trust that nobody edited it, that nothing was dropped, and that the export matches what was actually recorded. Most of the time you accept that because there is no alternative.