---
title: "Agent Constraints: Intelligent Tool Policies"
sidebarTitle: "Agent Constraints"
description: "Enterprise AI Safety for Tool Interactions"
---

<Card title="Prevent Unrestricted Tool Access with Smart Agent Governance" icon="shield-check">
  Move beyond "all or nothing" tool access with Agent Constraints – intelligent IF-THEN policies that provide precise control over agent autonomy and prevent unrestricted tool access in your organization's systems. Balance productive agent autonomy with security through conditional, context-aware restrictions.

  **Why Agent Constraints?**

  - **Conditional Logic**: Define precise conditions under which tools can be used
  - **Flexible Actions**: AUDIT or BLOCK tool usage based on context
  - **Defense in Depth**: Works alongside guardrails for comprehensive protection
  - **Enterprise-Grade**: Immediate policy enforcement with detailed compliance tracking
</Card>

## How Agent Constraints Work

Agent Constraints introduce intelligent pre-execution policies that evaluate conditions before allowing tool usage. These policies can help you prevent excessive agency by AI agents while maintaining your operational workflows. Policy Constraints can be defined on a Tool Definition or specific parameters.

## Policy Actions

### AUDIT

_Log and monitor tool usage for compliance tracking._

### BLOCK

_Prevent unauthorized tool executions entirely._

## Common Policy Examples

- Email Security - Constrain all Email Tool calls to addresses outside of your organization's domain.
- Database Protection - Prevent SQL query executions for database INSERT and DROP statements.
- File System Protection - Disallow agents from updating file content
- Compliance Monitoring - Audit all tool calls that involve customer-facing accounts
- Data Access Management - Constrain CRM Queries to specific non-sensitive tables

## Setting Up Agent Constraints

<Steps>
  <Step title="Access Agent Constraints">
    - Go to**Security Tab** 
    - Select **Runtime Security** from the left navigation
    - Navigate to **Agent Constraints** 
    - Click **"New Policy"** to start building
  </Step>
  <Step title="Define Scope">
    - **Choose scope**: All Projects, Specific Projects, or an AI Gateway
  </Step>
  <Step title="Define IF Conditions">
    - **Select tools**: Which tools this policy applies to. As you start typing tool names, auto-complete will list the available tools in your selected scope.
    - **Set parameters**: Define the specific parameter conditions that trigger the policy.
  </Step>
  <Step title="Set Action">
    - **AUDIT**: Log executions for monitoring and compliance
    - **BLOCK**: Prevent execution entirely
  </Step>
  <Step title="Apply and Monitor">
    - **Save and activate** your policy (takes effect immediately)
    - **Monitor violations** in Agent Constraint Enforcements feed
    - **Adjust as needed** based on usage patterns and feedback
  </Step>
</Steps>

<Tip>
  **Getting Started**: Begin with AUDIT policies to understand tool usage patterns before implementing BLOCK actions. This helps you fine-tune policies without disrupting workflows.
</Tip>

## Tracking Policy Violations

Navigate to **Feeds** in your left menu, select **Agent Constraint Enforcement**, then use the top filters to refine your view. You can investigate individual records to see more details about a specific policy and the user that triggered the violation.