Your AI agent will delete the database. Here's the checkpoint that stops it.

Everyone's racing to make agents smarter. Hardly anyone's building the boundary that decides what an agent is allowed to do.

Let me show you where that boundary lives. And why most people put it in the wrong place.

The two places you can stop an agent

Option one, the prompt layer. You write "please be careful, don't delete anything, double-check before you act." Most people stop here.

It's advice the model can disagree with. It's a suggestion written in the same channel as everything else the model reads. The model can be convinced to override it. That's not a bug. It's the fundamental weakness of putting the control inside the thing you're trying to control.

Option two, the runtime. You intercept the tool call before it fires.

A boundary that lives where the model can't argue with it.

Why the runtime wins

phinq is a transparent reverse proxy between an agent and its llm upstream. it forwards the request untouched, lets the model respond, then inspects the response for tool calls. the model's proposed actions, not its words.

each tool call is scored by a pure deterministic classifier. no llm in the loop.

• scores reversible? passes straight through, zero added latency.
• scores irreversible? bulk delete, truncate, credential read, permission escalation. the whole response parks and pings your phone. approve or deny.

fails closed. no answer within the window means denied, not allowed. the absence of a decision is a no.

Why the classifier being deterministic matters

it's not a model you trust or calibrate. it's a pure function. same input, same verdict, every time.

three reasons that matters:

1. it can't be reasoned around. there's no conversation with the classifier. the model can argue with its system prompt all day. the classifier doesn't listen to words. it scores structure. you can't talk your way past a deterministic function.
2. it's auditable. verdicts reproduce. replay any decision, get the same answer. that's what makes the audit log mean something.
3. it fails predictably. no variance. no "sometimes it decides differently." the boundary is boring on purpose. boring is safe.

The honest part: what it doesn't catch

the structural classifier catches what risky action is being attempted. it does not catch a clever prompt that produces innocent-looking calls. if an attacker gets the agent to do something destructive through calls that each individually look reversible, a risk classifier alone won't flag it. that's a real gap.

that's why the boundary is one layer, not the whole story. the audit chain records every decision, tamper-evident and hash-chained. byte-level proof of what happened and who decided.

The numbers, live

this isn't a demo. it's real operator telemetry, live today:

12,828 actions classified.
12,445 passed through.
383 held for a human.
293 approved. 51 denied. 35 timed out and denied by silence.
57 bulk deletes stopped. 172 credential reads stopped. 13 permission escalations stopped.
~97% of the automation ran with nobody in the loop.

models get smarter, so agents do more. that's exactly when the boundary around what they're allowed to do becomes the load-bearing part.

The question i keep asking

if you run agents unattended, how many tool calls happen that nobody would approve if they saw them first?

that's the whole reason this exists.

MIT licensed. drops into claude code, codex, any openai/anthropic-compatible agent, langchain, crewai, mastra, or over mcp. repo: https://www.phinq.co/