AgentPolicy – Policy gateway for AI agent tool calls

Policy control and tamper-evident audit logs for teams letting AI agents call external tools

Problem

Many people now use Claude Code, Cursor, and similar agents to automatically call tools, run commands, and access the network, but there is no unified security policy or traceable call record. Someone built a policy gateway with tamper-evident logs, and another built security review for vibecoded apps, showing that agent behavior auditing and permission control is a real and urgent need.

Solution

A local or cloud gateway that sits between agents and tools: define which tools, domains, and file paths are allowed, write every call to a tamper-evident log, and provide anomaly alerts and replay. Supports hooks for common agent frameworks.

Users

Small teams using AI agents, security engineers, platform engineering teams

MVP

YAML policy definitions for allow/deny rules; record input, output, and timestamp of every tool call; local web panel to view and search logs; webhook alerts; a CLI for quick onboarding

Revenue

Per-seat team subscription; free tier limited to local single-user; enterprise tier adds centralized logging, SSO, and compliance export

Why now

AI agents executing tool calls is now routine, but enterprise security and compliance teams lack visibility tools. Indie developers can quickly build a vertical wedge.