The Choke Point

Governing AI agents at the API call

The Frame

AI agents now act on enterprise data everywhere — and leadership can't see, govern, or audit any of it

This is shadow AI with higher stakes: agents don't just read data, they act on it — including an agent that attempts to exfiltrate customer PII.

So who governs work that flows through channels no one controls?

They act, not just readPROJECT-INTENT user story #1: an agent attempts to exfiltrate customer PII.

No visibilityCIOs / CISOs can't see who is using which agent on what data.

No policy, no auditNo control point and no tamper-evident record of what happened.

The Answer, Named

Amplifier Safeguard is a tenant-level gateway that intercepts outbound LLM API calls

The project frames itself as "a CASB (Cloud Access Security Broker), but for AI agent traffic" — sitting inline on the calls agents make.

Before we lean on it, is it real? Look at what's actually built.

A gateway proxyIntercepts outbound LLM API calls at the tenant level.

"A CASB, but for AI agent traffic"README framing of the product.

Managed in natural languageCIO interacts in natural language, not YAML or dashboards (README key property #3).

The Proof

This is a real, working system — not a concept pitch

Built by an autonomous development machine in about six weeks (2026-02-24 to 2026-04-06), tracked in STATE.yaml.

Real code — but it still has to govern traffic no one controls.

40,613

lines across 183 Python files (src/)

2,324

total commits

5,152

tests collected (201 files)

~6 wk

build span, autonomous dev machine

The Obstacle

You can't put an agent on every endpoint, or wait for AI vendors to cooperate.

The design commits to it explicitly: "No endpoint agent required. No framework integration required. No cooperation from the AI vendor required." So how do you govern traffic you don't control?

The answer is where all that traffic must pass.

The Choke Point

All agent work funnels through the LLM API call — so one inline point sees everything

From just the API call, the gateway determines WHO uses WHAT agent with WHAT capabilities to do WHAT work on WHAT data — no endpoint agent needed.

And once you sit inline, watching becomes controlling.

6

provider endpoints inline: OpenAI, Anthropic, Azure OpenAI, Google Gemini, Mistral (+ shadow_api, approvals)

1

choke point — the call all agent work must pass through

From Visibility to Control

Inline, the same call becomes control — and every decision is recorded

Content classifiers inspect traffic for policy, backed by a hash-chained, tamper-evident audit trail (audit_integrity + W-016 hash-chain, F-922).

But control only works if no one can quietly route around it.

5

classifiers: PII, sensitive data, prompt injection, secrets, response safety

W-016

hash-chain audit integrity (F-922 audit-integrity)

The Turn

A DNS backstop catches users who try to bypass the gateway with personal keys

Five enforcement-config generators route the whole network back through Safeguard — turning adoption from voluntary into mandatory.

With the last gap closed, the choke-point insight is fully realized.

Zscaler · Entra · FirewallConfig generators steer traffic to the gateway.

PAC file · DNSBackstop that catches shadow AI bypass with personal API keys.

5 generators totalsrc/safeguard/dns/generators/

The Payoff

One inline choke point, made unavoidable, closes shadow AI — instead of merely watching it.

Ungoverned AI agent traffic becomes complete visibility, real-time policy control, and tamper-evident audit — with no endpoint agent and no vendor cooperation required.

Status: Active · Phase 10-13 Production Readiness

Sources

Research Methodology

Data as of: 2026-04-06 (last commit). Feature status: Active — STATE.yaml phase 10-13 "Production Readiness" (epoch 4240).

Repository: ~/dev/ANext/amplifier-safeguard. Managed by an autonomous development machine (AGENTS.md).

Commands run:

Commits: git rev-list --count HEAD → 2324
Source size: find src -name '*.py' | xargs wc -l | tail -1; find src -name '*.py' | wc -l → 40613 lines, 183 files
Tests: .venv/bin/python -m pytest --collect-only -q tests → 5152 collected (201 files); pytest tests/gateway -q → 1485 passed
Providers: ls src/safeguard/gateway/endpoints/*.py → openai, anthropic, azure_openai, google_gemini, mistral (+ shadow_api, approvals)
Classifiers: ls src/safeguard/content/classifiers/*.py → pii, sensitive_data, prompt_injection, secrets, response_safety
DNS backstop: ls src/safeguard/dns/generators/ → zscaler, entra, firewall, pac, dns
Audit: grep -rln 'hash_chain|HashChain|tamper' src/safeguard/; grep W-016 STATE.yaml → audit_integrity.py, W-016, F-922
Timeline: git log --reverse --format='%ai %h %s' | head; git log -1 --format='%ai %h %s' → 2026-02-24 to 2026-04-06 (~6 weeks)
Contributors: git shortlog -sne --all

Primary contributors: Sam Schillace (1973 + 118 commits; the two emails are one person, a git-config artifact); Amplifier Dev Machine (168); Safeguard Monitor (65).

Gaps: "sub-50ms / <100ms" latency are stated design targets, not measured benchmarks. Only tests/gateway (1485) was run end-to-end; full 5152-suite pass rate unverified. "Meridian Financial" is synthetic demo data — no production deployment evidenced. STATE.yaml flags several features "not auto-wired" as deferred findings.