We built a circuit breaker for AI agents — here's why it matters
An agent gets a routine cleanup task. It lists old records, constructs a SQL statement, and calls the database tool. A missing tenant filter turns the intended delete into a production-wide delete. The tool call is syntactically valid, the database accepts it, and the agent reports success. The same failure mode appears with APIs. An agent enters a retry loop around a non-idempotent endpoint and…
Every team deploying tool-using AI agents faces a critical boundary: the transition from model output to shell, database, or HTTP API calls. Frameworks simplify this process but lack the ability to determine whether destructive actions, like deleting critical tables or files, are appropriate for a given situation. Application code can add checks for individual tools, but this approach quickly becomes fragmented as different tools require different policies.
The solution lies in a middleware layer called Agentwall, which sits immediately before dispatch and acts as a control point for all tool calls.
Agentwall intercepts Python and TypeScript functions, intercepting calls to bash, SQL, HTTP APIs, function calls, and LangChain tools. It classifies each call as safe, cautious, or destructive based on the arguments provided. Trusted read-only SQL queries are safe by default, while file writes and destructive SQL statements are marked as cautious, and recursive deletions or authenticated mutating HTTP requests are labeled destructive.
By default, destructive calls require human approval before execution, which can be handled through a CLI prompt or an internal dashboard and approval workflow. If the approval process fails, the call is blocked, preventing uncontrolled execution. Agentwall also logs every attempt, including blocked calls, with detailed JSON events that include timestamps, session and agent IDs, tool names, redacted arguments, classifications, decisions, outputs or errors, and execution durations.
This structured logging enables teams to track what agents attempted to do versus what actually ran.
Furthermore, Agentwall supports rollback operations for certain actions, allowing for compensating behaviors like deleting files created during a destructive call or restoring previous configurations. These rollback hooks are registered after the forward call succeeds and are executed in reverse order if the session fails or is aborted. While not a distributed transaction, this approach ensures consistent recovery and provides a clear path for remediation.
Agentwall is intentionally small and framework-agnostic, sitting around existing tools rather than requiring tools to be moved into a hosted runtime. It does not own the agent loop, preserving the flexibility of current AI agent architectures. To implement Agentwall, teams can try it out around a real tool, inspect the JSONL output, and test both approval outcomes.
Feedback is welcomed through starring the repository and opening issues for additional framework adapters or policy primitives that may be needed in specific deployments.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
