What a gateway can’t see

An AI coding agent is two events, not one. The model says what to do. Then something on a machine does it. Almost all of the tooling built so far governs the first event. The damage happens in the second.

One walk-through settles it. A developer runs Claude Code with ANTHROPIC_BASE_URL pointed at a gateway. The model returns a tool_use block: Bash, rm -rf build/. Claude Code spawns that process on the laptop.

The gateway never sees it. Its next sight of anything related is the text of the result in the following request — after the fact, as a string, with no exit code and nothing to undo. It can censor the model’s suggestion on the way out. It cannot observe the act.

What follows from standing there

We’ll use LiteLLM as the example, because it’s the most widely deployed open-source gateway and documents itself well enough to check.

Ask-a-human doesn’t reach the CLI agents. The harness does have an on_approval callback, and ask mode works for LiteLLM’s own Deep Agents and Tool Loop runtimes. But in their words: “The CLI harnesses don’t support it in this release and raise CapabilityUnsupported” — and the CLI is where Claude Code, Cursor and Codex live.

Governance is an environment variable. Unset the base URL and the gateway is gone. That isn’t a criticism of the implementation; it’s what a proxy is. But a control a developer steps around by editing one line of their shell profile is a routing preference, not a policy.

The audit is ordinary rows. It records create, update, delete and regenerate on keys, teams, users and models — management operations, not tool calls — it is an Enterprise feature, and nothing in the docs describes hash chaining, signing or tamper-evidence.

Credit where it’s due, twice. For MCP servers registered with the gateway, pre-call guardrails allow or deny before the upstream server is contacted — real pre-execution control, well built. And an approval nobody answers is denied rather than allowed; they fail closed, as they should. Neither of those reaches Bash, Write, Edit, or a locally configured MCP server, which on a developer’s machine is most of what happens.

What sits in the second event

Myla’s Gate runs as a hook inside the agent’s own execution path, so every tool call reaches it before the call runs. Four things follow from that position. We went looking for prior art on each rather than assuming.

It notices when an agent stops reporting. The cheapest way past any hook is to remove it. Myla learns each agent’s own rhythm and flags the break against that agent’s history, not a global clock. The standards body filed this as a bug — “No on-wire signal lets a Guardian detect missing hook coverage from an Observed Agent” — and deferred the fix to a later version. Their description of the problem: “The Guardian has no way to tell ‘no toolCallRequest fired this turn’ apart from ‘agent took no actions this turn.’” We could not find a product that answers it today. What the market calls bypass detection is posture scanning for risky settings, which is a different thing.

An unknown tool is reported, not waved through. Meet a tool with no classification and the verdict carries an explicit unclassifiedTool marker. Myla neither guesses it is safe nor blocks the developer’s work. Fail-closed-on-unknown exists elsewhere; annotating the unknown on the decision itself appears to be unclaimed.

No model anywhere in the decision path. Most products that call themselves deterministic are deterministic in enforcement while a model-based detector feeds the decision. Myla’s provenance signal comes from structural session state, so the same inputs always produce the same verdict — and there is nothing in the path to prompt-inject.

The ledger sits where the agent cannot reach it. Several hash-chained logs in this space are written by a process running as the same OS user as the agent; their own docs say so. That is tamper-evident, not tamper-resistant. Myla’s is written server-side by the Gate, never by the machine being governed.

Why this layer, now

The serious players are converging on this control point. Databricks’ Omnigent — open source, in alpha — carries a lethal-trifecta policy that tracks the same three legs as session state and denies the outbound call once the first two are lit. Palo Alto ships Cortex Agentic Endpoint Security, an AI-native control plane for governing autonomous agents on enterprise endpoints. Eighteen months ago nobody was building here at all. The question isn’t whether this layer matters — it’s what is still missing inside it.

How to check us

We publish precision and recall every release, with the cases we already know we miss held inside the rates rather than quietly dropped. The numbers are at /how-we-measure.

See it block something

There’s a demo that needs no account and installs nothing. An agent reads an issue filed by a stranger, then reads your customer table, then tries to send mail. Each step is fine on its own; the third is blocked. Real policy engine, invented data, running in your browser.