Tripwire

Agencies running agents for clients need a point where repeated failures, budget overruns or prohibited actions can stop execution rather than produce another alert. The supplied research confirms an open observability proxy with rate limits and fallbacks plus a free policy engine, but finds no combined pre-action halt and human-review product. The original stage verified one interface. Tripwire can control only traffic routed through its enforcement point and only before the external side effect is dispatched. It cannot undo a payment, message, deletion or transaction already accepted by a provider. Each tenant owns explicit rules for tool, resource, field, environment, quantity, cost, retry count, time and approval. Model self-confidence is not a calibrated safety signal and cannot alone authorize or halt action; it may create a review candidate only under a tested policy. Repeated failures require normalized error evidence and idempotency so a retry loop is not confused with several independent tasks. Cost observations require complete provider usage and currency rules. Request, policy evaluation, block or pause, human notification, queue acknowledgment, human acceptance, approval or rejection, resumed command, provider acknowledgment, destination readback, compensation and incident close remain separate. The product fails closed for prohibited high-impact actions while preserving safe cancellation and urgent fallback, and never claims universal compliance from a middleware boundary.

An agency platform, security or risk team operating client agents and needing one enforceable policy boundary across routed model and tool traffic.