An AI agent calls tools: it writes files, sends mail, queries databases. Before it does, something should decide whether it may. flux7 makes that decision from beside the agent rather than inside it, so the agent's code does not change.
Today, the questions below have no good answer, and answering them is not the agent framework's job. They are infrastructure questions, the same ones service meshes answered for microservices a decade ago.
Which agent may call which tool? Frameworks do not enforce boundaries. An agent can call anything it discovers.
Who approved that action? Someone clicked yes in a terminal three weeks ago, and no record of that decision remains.
What actually happened? There are logs somewhere. However, they are unstructured and cannot be queried or audited.
A request climbs only as far as it needs to. Most never leave the first step. The second step keeps every read a human approved, and that approval answers the next identical request on its own. A write, however, always asks again.
agent ──► L0 policy engine rules say allow, deny or ask <1ms
│
├─► L1 memory 3 human approvals, reads only ~100ms
│
├─► L1+ arbitration rules, then a decision model ~350ms
│
└─► L2 human the genuinely new decisions minutes
every decision is written back as a fact; a read a human approved answers the next one
The sidecar ships as one Go binary configured by one YAML file. It speaks MCP over stdio and HTTP as well as plain REST, and the agent never knows it is there.
This store keeps decisions as facts rather than as log lines, so they can be recalled and reused instead of asked again.
The supervisor runs the arbitration step. A rules engine answers first, then a decision model (Jev, by TypeSafe) answers narrow questions in a few hundred milliseconds. The code decides from the model's probabilities, and a local model takes over if Jev is down.
The console is the human end. It shows pending approvals and the policy in force, as well as what the agents have been doing.
An API gateway governs traffic between a user and a model. An agent framework runs the agent's own loop. flux7 sits at a third place, between the agent and the tools it reaches for. There it applies one policy per agent and per tool, and its approval queue does not block. Every decision is also kept where it can be queried.