Can Decionis govern AI agent tool calls before they execute?

[ocularminds]

Agents increasingly call tools that move money, change records, deploy code, or spend tokens. Can Decionis evaluate a tool call before it runs, rather than reporting on it afterwards — and what does that look like for the common agent frameworks?

[ocularminds]

Yes — a tool call is just an intent, and it goes through the same gate as any other high-stakes action. Policy is evaluated before the call runs; the outcome is allow / block / escalate; a Decision Dossier is emitted either way.

There are four ways to wire it, depending on where your agent lives.

1. MCP — @decionis/mcp

A stdio MCP server that lets an agent evaluate a candidate action before it commits, deploys, or migrates anything. It exposes decionis_read_policy, decionis_evaluate, and decionis_verdict_help.

npx -y @decionis/mcp

One important distinction: MCP is the discovery and explanation surface; the native hook is the binding enforcement surface. An agent can choose to call an MCP tool. A PreToolUse hook intercepts every supported tool call outside the model's discretion — that's what you want when the gate has to be non-optional. APPROVE returns no permission override and the call proceeds; REJECT, REVIEW, and ESCALATE all stop it.

2. LangChain / LangGraph — @decionis/langchain

Wrap the tool, not the agent:

const gatedRefund = DecionisGateTool.wrap({
  innerTool: sendRefund,
  client: decionis,
  orgId: process.env.DECIONIS_ORG_ID!,
  decisionType: "refund_execution",
  siteBaseUrl: "https://decionis.com",
});

await agent.bindTools([gatedRefund]);

A blocked call raises DecionisGateRefusal, so the agent sees a refusal it can reason about instead of a silent failure. There's also a LangGraph node factory (decionisGateNode) if you'd rather gate at a graph edge.

3. AWS Bedrock — @decionis/bedrock-guard

wrapBedrockActionGroup(handler, { config, siteBaseUrl }) wraps a Bedrock action group handler. Note that this guard is built for availability-first deployments and its failure posture is configurable — check the package README and set it deliberately for your risk profile rather than taking the default on faith.

4. Direct SDK call — @decionis/sdk

If your agent isn't in one of the frameworks above, call the gate yourself with enforceAndExecute — see Where does Decionis sit in the stack? for the full example.

Worked example. Autonomous trading is the case we exercise hardest: CFD_TRADE_EXECUTION decisions carry deterministic rules on leverage, margin buffer, and missing stop-loss / take-profit, so a trading agent's OPEN_POSITION is gated on the consequence of the trade rather than on a model's confidence. Autonomous spend is gated the same way — a SEND_PAYMENT against a wallet resource runs under an explicit spend policy.

---

Related: What is Decionis, in plain terms? · Where Decionis sits in the stack · How Decision Dossiers are verified

Have a different architecture or integration question? Start a new discussion — we answer publicly whenever we can.