Twenty tool calls in a chain, at 71 milliseconds each, add 1.42 seconds of wall clock [3]. That arithmetic is why this is a small-model product. Capsule's own framing is that reviewing agent behavior before it happens commonly costs too much latency to be usable, and that post-incident monitoring only finds the problem after the damage [12]. Two fine-tuned classifiers doing one narrow job, trained on real agent traces, human review and adversarial examples [6], fit inside the loop in a way a general-purpose reviewer called on every step could not.
The install is the harder half. The evaluator has to see the intended action before the runtime executes it [1], which means the agent's tool calls have to pass through something that sits outside the agent [11]. Where an agent invokes its tools in-process, through SDK calls in the same program, there is no seam to insert a veto at. Creating one is application work, and it lands on whoever owns the agent rather than on the committee that wrote the AI usage policy.
On accuracy, everything published so far is Capsule's own measurement. The claimed margin over the strongest third-party model it evaluated is 10.9 points [1]. Read as misses, that is 3.1 percent of rogue steps getting through against 14 percent, about a 4.5x difference in what reaches the tool [2]. SC World, citing Silicon Angle, says the fine-tuned model outperformed frontier systems from OpenAI, Anthropic and Google [9]. Neither account publishes a false-positive rate [5], and for a control whose action is "block", precision is what decides whether it stays in blocking mode after the first week.
The category is arriving alongside the exposure. SecurityWeek's related coverage lists an agent firewall startup out of stealth with $50 million, a product that adds a human check to risky agent actions, and a UK government agentic AI defense plan [13]. It also lists a critical vulnerability exposing GitHub agentic workflows to prompt injection [14]. That last one is the attacker path this class of product is aimed at: the agent is authorized and the tool call is well-formed; the only place left to catch the instruction that came from poisoned content is between the reasoning and the execution [1].
Paz puts the risk as what autonomous agents can decide to do by themselves [15]. Acting on that is plumbing before it is procurement: every agent tool call routed through one broker the security team owns, and the runtime patched to wait for its answer.
