The control layer · Definition

The layer that decides before an agent acts.

An agent control layer is a service that sits in front of an AI agent's actions and decides, before each one runs, whether that agent may take it. Kordio is one: it holds policy you wrote, answers allowed, needs a human, or denied in the same call, and signs what it allows so whoever executes verifies the authority.

See one decision What one has to do

Definition

What an agent control layer has to do.

The term is new and vendors use it to mean different things. Kordio has an obvious interest in the definition, so here is the version that is useful whoever you buy from.

Decide before, not report after.
The check runs in the path of the action and returns in time to stop it. Anything that tells you afterwards is a record, and a record binds nothing that already had the means to act.
Hold state the agent cannot hold.
A ceiling on one transaction is not a budget. Knowing that this agent has $340 left this month means keeping a running total across runs, sessions and sub-agents, outside the process being limited.
Govern actions, not just payments.
A paid tool call is spend. If the layer only understands card transactions, the largest line on an agent operation is invisible to it, and limits on one kind of spend do not constrain the other.
Produce something an executor can verify.
A decision only the agent carries is a claim. A signature over exactly what was permitted lets whoever executes check the authority without calling back and without trusting the caller.
Name the rule, later.
Months afterwards, someone asks who approved a payment. The answer has to be a rule and a decision on record, not a code review from six weeks ago.

The shape of it

Ask, decide, sign.

Whatever the vendor, the loop is the same. The agent asks before it acts, something outside the agent decides, and the answer travels with enough proof that the executor does not have to trust the asker.

ASK

The agent describes the action

An agent, a session, an action type, a resource, and a cost. Described before it happens, not reported after.

DECIDE

Policy runs outside the agent

Caps, windows, allowlists and approval thresholds evaluate together, and the first rule that decided is the one named in the answer.

SIGN

The answer carries proof

An allowed decision comes back signed and short-lived, so the executor verifies the authority offline instead of taking the agent's word.

Not this

Things that get called a control layer and are not.

Each of these is a real tool that does a real job. None of them is the thing described above, and buying one expecting the other is the common mistake.

Content guardrails

Validate what a model says: jailbreaks, toxicity, schema. They run on text and they hold no budget, so an agent can be perfectly well behaved and still spend your month by lunchtime.

Spend dashboards

Report what was spent, sometimes hours later, and raise an alert past a threshold. Useful, and an alert is not a denial. Nothing about a chart stops the next call.

Agent identity

Establish which agent is calling and issue it a credential. That settles who, which is necessary and not sufficient, because a valid credential still spends whatever it is pointed at.

Position

In the call path, or nowhere.

The honest limit, stated plainly.

A control layer only binds the paths you route through it. An executor that never asks Kordio and never verifies a signature is not governed by it, and no amount of policy changes that. This is worth knowing before you buy, from anyone.

The mitigation is the next sentence: put the check in front of the spend, in code the agent cannot skip, and have the executor require a signature. Once it does, an agent that skipped the check has nothing to present.

Every decision is recorded in an append-only audit trail, linked by trace id, on every tier. See what comes back

What the executor checksES256, no callback

{
  "decision": "allowed",
  "rule": "cost_cap.vendor_payments",
  "remaining_cents": 34000,
  "cosignature": "eyJhbGciOiJFUzI1NiJ9..."
}

Verified against a public key set at api.kordio.io, with no call back to Kordio and no shared secret.

Terms

Words that get used interchangeably and should not be.

Is a control layer the same as guardrails?+

No. Guardrails usually validate content: what a model says. A control layer decides actions, holds budget state across runs, and returns a decision an executor can verify.

Is it the same as observability or FinOps tooling?+

No. Those report what was spent after the fact. A control layer answers before the action runs, and a denial means the spend never happened.

Do I need one if I only run one agent?+

Probably not. A hard-coded cap in your own code is fine for one agent with one ceiling. The trigger is the second agent, or the first time someone asks who approved a payment.

What happens if an agent skips the check?+

It is not governed. A control layer binds the paths you route through it, which is why the executor should require a signature rather than trusting the caller.

The layer that decides before an agent acts.

What an agent control layer has to do.

Decide before, not report after.

Hold state the agent cannot hold.

Govern actions, not just payments.

Produce something an executor can verify.

Name the rule, later.