ALLOW
Continue the action
The available context satisfies the applicable policy, so the integration can proceed.
Thoth · Runtime control
Decide what AI agents can do next.
Thoth evaluates consequential tool calls using policy and runtime context, returns a policy decision, and preserves evidence for review. Your integration handles the response before the tool runs.
01
Agent request
Action, identity, task, and resource context
02
Policy evaluation
Thoth evaluates the available context
03
Workflow response
The integration proceeds, requests review, or stops
04
Decision evidence
Policy, outcome, reason, and integrity references
Request lifecycle
A decision path built around the action.
Thoth sits in the execution path selected by the customer. Each request follows a clear lifecycle from context to evidence.
Stage 01
Receive action context
Collect the identity, task, session, tool, resource, and environment details available for the requested action.
Stage 02
Evaluate policy and risk
Apply the organization’s policy to the available context before the tool reaches its target.
Stage 03
Return an execution decision
Tell the integration to continue, request additional approval, or stop the action.
Stage 04
Preserve decision evidence
Record the decision inputs, applicable policy, outcome, and integrity data for later review.
Execution decisions
Control how your workflow responds.
The TypeScript SDK defines five outcomes. Your integration must handle the response and fields supported by its version.
STEP_UP
Require additional authority
Pause the action for an approval, stronger authentication, or another customer-defined check.
BLOCK
Stop the action
The request conflicts with policy or lacks the context required to continue safely.
MODIFY
Adjust the requested action
A supporting integration applies the modified tool arguments returned with the decision.
DEFER
Hold for more context
The action waits for additional context or authority. The integration must handle the hold and any timeout explicitly.
Support and handling vary by SDK version and integration. Review the decision reference for your deployment.
Integration paths
Put policy close to execution.
Choose the control point that fits the application architecture and operational model.
Path 01
SDK
Add evaluation in application code when the team wants direct control over context collection and decision handling.
Path 02
Gateway
Place a shared policy boundary between agents and tools when multiple workflows need a consistent control point.
Policy context
Decisions use more than identity alone.
Available context is supplied by the integration and evaluated against customer-defined policy.
01
Identity
02
Task
03
Session
04
Tool
05
Resource
06
Environment
Decision evidence
Keep the record connected to the decision.
Evidence exports give security, engineering, and assurance teams a shared record for investigation and customer-defined audit workflows.
- 01Request and decision identifiers
- 02Available action context
- 03Policy and rule references
- 04Decision and reason
- 05Timestamp and integrity data
- 06Export references for downstream review
Deployment and operations
Fit controls to the environment and workflow.
Architecture, availability requirements, and decision handling are defined during deployment.
Architecture
Aten-managed
Use a managed control path with deployment boundaries and data handling confirmed during evaluation.
Customer-controlled
Discuss an architecture aligned with customer network, hosting, and operational requirements.
Operational modes
Observe
Evaluate requests and review proposed outcomes without asking the integration to interrupt execution.
Enforce
Apply customer-configured handling for the decisions supported by the selected SDK or gateway version.
Use cases
Control the actions that carry consequence.
Sensitive data access
Require context or approval before an agent reads, exports, or changes protected records.
Financial and administrative actions
Apply explicit policy before workflows move funds, change permissions, or modify critical systems.
Tool and connector governance
Use a common decision model across supported tools while preserving evidence for review.
FAQ
Questions about Thoth.
Does Thoth replace identity or observability tools?
No. Thoth uses available identity and runtime context to decide what an authorized agent may do next.
Can teams evaluate policies before enforcing them?
Yes. Observation and enforcement modes can be applied according to the deployment and workflow.
How are decisions integrated?
Teams can use an SDK or gateway pattern and define how their workflow handles each outcome.
What evidence is available?
Decision records can include available context, policy references, outcomes, reasons, timestamps, and integrity data.
Build a deliberate control point
See how Thoth fits your agent architecture.
Review the actions, context, integration path, and operating mode that matter for your environment.