AgentFence

Agents can cook, just not outside their permissions. AgentFence enforces runtime boundaries and gives you receipts for every delegation, denial, and action.

Comment

AgentFence

Adaptive runtime governance for AI agents.

Hard governance decides what is legal. Adaptive routing decides what is useful. A routing score can never override a denial.

Inspiration

Most agent systems make a structural decision too early. A workflow is designed as either a single agent or a fixed multi-agent graph before execution begins, even though the real shape of a task only becomes clear at runtime.

One user request can expand into model calls, tool calls, delegated workers, protected-resource access, context handoffs, artifacts, and shared cost.

We asked:

Why should agent topology be fixed before the runtime knows what the task requires?

AgentFence treats topology as a governed runtime decision. It can expand into specialists when the task benefits from specialization or parallelism, then contract back to the current agent for synthesis.

Dynamic delegation also creates risk. The system must control what each invocation can do, what context a child receives, which protected resources it can access, what it may return, and how far execution can expand.

That boundary is AgentFence.

What it does

AgentFence sits between the application control plane and the agent execution runtime. The workload declares what work exists. AgentFence decides who executes it and how.

Authority is evaluated per invocation

Authority answers: “What is this invocation allowed to do?”

In our Travel workload, the root agent’s passport capability is configured as:

exercise: not allowed
delegate: allowed

This represents an important distinction:

A parent may be allowed to cause an action without being allowed to perform it.

The root cannot read the passport itself, but it may delegate identity verification to a specialist with narrower authority.

Governance filters before routing

Authority and runtime budget jointly define the legal execution options:

legal option = authorized AND affordable

Illegal or unaffordable options are removed before the adaptive router ranks anything. Budget includes runtime concerns such as token usage, delegation depth, child slots, and parallelism. It is separate from domain constraints such as the traveler’s SGD 700 spending limit.

Adaptive WHO and HOW decisions

For each ready task, the Governor chooses along two axes:

WHO
- REUSE_CURRENT
- DELEGATE_SPECIALIST

HOW
- DIRECT
- SERIAL
- PARALLEL

Independent exploration can expand into parallel specialists. Final synthesis can contract back to REUSE_CURRENT / DIRECT.

The result is an adaptive topology rather than a permanently fixed agent graph.

Delegation changes authority, context, and return data

A separate model call is not automatically a security boundary. AgentFence makes delegation meaningful by changing three things together:

  • Least authority: A child’s authority envelope is derived by attenuation, never copied. Delegation depth, child slots, and delegatable capabilities can only decrease.
  • Least context: A specialist receives only the authorized context needed for its task. Unrelated context is withheld, and the projection is recorded.
  • Bounded return: Child output passes through a Return Gate and must match a declared schema before the parent can receive it.

For identity verification, the parent receives only four booleans:

identity_verified
booking_name_matched
travel_document_valid
destination_eligible

The passport contents, child context, and raw model output never reach the parent.

Execution history becomes runtime state

execution
-> provider usage and outcomes
-> Governance Ledger
-> RunState
-> next routing decision

Usage is not only displayed as a metric. It becomes state that later routing decisions read.

Evidence comes from the backend

The read-only Runtime Governance Inspector displays task state, run pressure, routing decisions, authorization verdicts, delegation scope, context projection, and bounded returns.

Every field is labelled:

OBSERVED
DERIVED
DECLARED
UNAVAILABLE

When the backend has no evidence, the UI reports UNAVAILABLE instead of inventing a value. The browser explains backend truth; it does not create it.

The demo

Our reference workload handles a cancelled flight from Singapore to Tokyo. The traveler must arrive before 1 PM the next day, keep additional spending below SGD 700, and approve anything above SGD 300.

The workload declares this task graph:

understand_disruption
        |
        v
search_transport ---------+
                           +-- may run in parallel
search_accommodation ------+
        |
        v
plan_local_arrival
        |
        v
verify_identity
        |
        v
validate_recovery_plan
        |
        v
final_recovery_plan

The graph defines the work and its dependencies. It does not permanently assign Transport, Hotel, or Identity agents. Those roles emerge from runtime decisions.

The main enforcement moment is:

root
-> identity/passport
-> DENY
-> NOT_EXERCISABLE_DELEGATE_ONLY

The backend denies the root’s passport request. AgentFence then creates a narrower identity specialist, authorizes it separately, and allows it to read the passport through the Resource Gate.

The specialist returns four booleans through the Return Gate. The same resource is denied to the parent and allowed to the narrower child, with both decisions recorded in the ledger.

Travel is a reference workload because it makes parallel work, sensitive data, spending limits, approvals, and bounded results understandable within a three-minute demo. AgentFence itself is domain-independent middleware.

How we built it

React frontend
      |
      v
Fastify API
      |
      v
Adaptive Agent Runtime Governor
      |
      v
Container Runtime + Codex CLI
      |
      v
Volcengine Ark

Inside the Governor:

                 GOVERNED RUN
                      |
          +-----------+-----------+
          |                       |
          v                       v
       AUTHORITY             RUNTIME BUDGET
          |                       |
          +-----------+-----------+
                      |
                      v
                  LEGAL SPACE
          authorized + affordable
                      |
                      v
               ADAPTIVE ROUTER
                   WHO + HOW
                      |
                      v
              EXECUTION ENGINE
       context, delegation, and gates
                      |
                      v
             GOVERNANCE LEDGER
          +-----------+-----------+
          |                       |
          v                       v
   next decision          read-only Inspector

The separation is deliberate. Governance removes illegal choices first. The router then selects among the remaining legal options. This prevents safety, cost, authority, and routing preference from collapsing into one opaque score.

Challenges we ran into

Making delegation safer than parent execution

Spawning a child is not a security boundary if the child inherits the same authority, context, and unrestricted return path. We made delegation change all three at once. The passport path became the clearest test of whether that boundary was real.

Keeping the UI evidence-based

It would have been easy to simulate governance in the frontend. Instead, the Inspector is read-only and all displayed governance state comes from backend ledger projections.

Closing the feedback loop

Usage accounting only affects governance if later decisions can read it. We built a real path from provider-reported usage into the ledger, then into RunState, and finally into the next candidate snapshot.

Failing closed with real providers

Live execution introduces rate limits, transient failures, and malformed output that deterministic demos do not expose. AgentFence fails closed instead of silently bypassing governance, which made the system safer but the live demo more challenging to stabilize.

Keeping Travel separate from the product

Travel is visually intuitive, but AgentFence is not a travel application. We kept domain policy in the workload layer and made the middleware depend only on reusable task, authority, context, artifact, budget, and evidence contracts.

Accomplishments that we’re proud of

  • Topology is a runtime decision. A single run can reuse, delegate, parallelize, and contract as conditions change.
  • May exercise and may delegate are different rights, enforced by the backend.
  • Delegated workers receive narrower authority and least-privilege context.
  • Cross-agent results are schema-validated and bounded by a Return Gate.
  • Real provider usage feeds later governance decisions.
  • The Inspector remains outside the control path.
  • The system includes 432 tests across 38 files, covering authorization denial, forged authority, delegation attenuation, budget exhaustion, context redaction, artifact validation, Return Gate behavior, adaptive routing, and governed-run projections.

What we learned

More agents are not automatically better. Sometimes the right decision is REUSE_CURRENT / DIRECT. Adaptive execution makes expansion available, not mandatory.

Delegation is only a security boundary when authority and information change. Otherwise, it is just another model call.

Governance and routing are different questions. “May this happen?” and “Which legal option is best?” should not be answered by the same mechanism.

Observability is not evidence. A dashboard can display convincing values without proving anything. Useful evidence must originate from the execution path.

The workload should describe work, not infrastructure. The task graph became cleaner when we stopped assigning permanent agent roles and let the runtime decide the execution topology.

What’s next

We want to apply AgentFence to additional workloads:

Domain Parallel work Protected resource Approval boundary Bounded result
Incident response Telemetry analysis Incident evidence Production change approval Remediation proposal
Coding and review Implementation and tests Secrets or production configuration Merge approval Patch artifact
Data operations Parallel queries Restricted datasets Export approval Validated result set

We also plan to:

  • Expand the authority model with richer capability policies and deeper delegation chains.
  • Extend runtime budgets to monetary cost, tool calls, latency, memory, and concurrency.
  • Improve explanations of which candidates were rejected and why a route was selected.
  • Support more execution backends through the same run-level governance contract.
  • Add stronger identity, isolation, transactional logging, and distributed coordination for production use.

The workload changes. The runtime Governor does not.

Built With

Share this project:

Updates

Submission history