Arcjet's guard returns allow or deny one call before the refund goes out

The two integration paths do not cost the same. Observe ingests OpenTelemetry events with no application-code change, and it stitches prompts, tool parameters, identities, session metadata and security decisions into one sequence ^[4]. Arcjet can also pull activity from Anthropic's Claude Compliance API ^[5]. Enforcement needs a developer to put a guard immediately before the tool call or other action boundary ^[6].

The policy language is Rego, evaluated through Open Policy Agent, with rules managed centrally by the security team while the application only receives an allow or deny before the side effect runs ^[7]. Reusing an existing policy engine means the rules live and get reviewed outside the application repository.

A refund guard receives the authenticated user's identity, role and the proposed amount, and the application can block the refund, route it for human approval, or explain the denial to the agent ^[8]. That third option puts the policy decision back into the model's context as text. The same interface covers email recipients and attachments, web-fetch allowlists, prompt-injection detection, redaction, rate limits and usage caps ^[9].

Arcjet's agent guard documentation states the tradeoff directly: the application owns the final enforcement point ^[10]. That is where the actor, the target resource and the exact tool arguments are available, and a network firewall or model gateway may lack them ^[10]. The same documentation says engineering teams have to cover the action boundaries that matter, and an unwrapped tool or workflow step stays outside the enforcement path ^[11].

"A risky outcome can develop across a series of steps that look perfectly reasonable on their own," Mytton said in the launch announcement ^[12]. Reviewing each event on its own can hide the outcome the full chain produces ^[23]. Mytton started Arcjet in 2023, after founding Server Density in 2009 and running it to its 2018 merger with StackPath ^[19].

For this design to work in a given codebase, the side-effecting call sites have to be enumerable and few enough to wrap. Arcjet lists native support for eight frameworks and agent SDKs, including the Claude Agent SDK, the OpenAI Agents SDK, LangChain, Mastra and Microsoft's Agent Framework ^[13][14]. Its JavaScript, Python and Go SDKs also cover queue jobs and background workflows that never receive an HTTP request ^[15].

After the action, the record holds the inputs, the policy version, the decision and the execution context ^[16]. Retention can sit in Arcjet's cloud, a single-tenant deployment or a private VPC, or the logs can go to an existing security system ^[17]. Certain sensitive-information detection can run inside the customer's own process ^[18].

The launch material does not include pricing beyond the free 15-day trial, or latency figures for a guard that sits in front of every wrapped tool call ^[3][22].