How to block AI agent actions in real time

To block AI agent actions in real time, check each tool call after the model proposes it and before your code runs it. Put that check somewhere the model can’t edit, and make it deny the call when the check itself errors or times out. Claude Code hooks, the OpenAI Agents SDK’s tool guardrails and approvals, LangGraph interrupts and MCP gateways all give you that moment, and each sees only part of what an agent can do.

The defaults need a careful read. Copilot Studio runs a tool if your security endpoint hasn’t answered within one second, unless an admin changes the setting.¹ A Claude Code hook that times out doesn’t block the call it was written to check.²

This guide covers where a check can sit, what each mechanism can and can’t block as of 30 October 2026, and how to decide what to block automatically and what to send to a person.

Four places to block AI agent actions in real time

Every action an agent takes passes four points where you can stop it or limit the damage, and each point sees something different.

Before the tool call. The agent runtime holds the tool’s name and full arguments before anything runs, so a hook or middleware there can deny the call, change its arguments or pause it for a person. It sees only the tools that runtime executes, and once it lets a shell command through, it has no view of what the command does.

At the tool or API boundary. A gateway or proxy between the agent and its tools applies one policy to every agent and framework that routes through it, out of reach of the agent’s code. An MCP gateway sees only MCP calls, and an egress proxy only outbound connections. In February 2026, Anthropic’s red team phished an employee into running a prompt that told Claude Code to read AWS credentials and send them to an outside server, and Claude did so in 24 of 25 attempts. Anthropic concluded that only egress controls and filesystem boundaries hold against an attack like that.³

At the credential layer. A credential scoped to the task makes out-of-scope calls fail at the API, whatever route the agent takes. Stripe recommends restricted keys for any key you give an AI agent, GitHub App installation tokens expire after an hour, and an AWS STS session can be as short as 15 minutes.⁴⁵⁶ Credentials are coarse, though. They can’t say that refunds above £50 need a person.

After the call. Audit logs, alerts and rollback decide how fast you notice and how much you can undo. Claude Code’s checkpoints restore files its editing tools changed, and they don’t track files changed only by shell commands.⁷ A sent email or a payment can’t be rewound at all. When a poisoned tool result steers an agent into sending data out, Anthropic notes, “the log just shows a successful, authorized API call”.³

Our containment lessons cover egress allowlists and per-run credentials in depth, so the rest of this post concentrates on the first two layers.

AI agent guardrails compared, as of 30 October 2026

Each row comes from the vendor’s documentation as of 30 October 2026. The fifth column shows where a failed or slow check lets the call through.

Sources: Claude Code and Agent SDK docs,²⁸⁹¹⁰ OpenAI Agents SDK docs,¹¹¹² LangChain and ADK docs,¹³¹⁴ agentgateway docs,¹⁵¹⁶ AWS docs,¹⁷¹⁸ and Microsoft Learn.¹⁹¹

Claude Code hooks and permission rules

Claude Code checks each tool call in two layers before it runs. Permission rules are evaluated deny first, then ask, then allow, so a narrow allow rule can’t carve an exception out of a broad deny.⁸ A PreToolUse hook receives the tool name and full input as JSON once Claude has written the call, and can allow it, deny it, ask the user, defer it in headless runs or rewrite its input.² A hook’s allow never overrides a deny or ask rule, and a hook that blocks stops the call before allow rules are checked.⁸

Three details decide whether a hook works as a gate. A command or HTTP hook that times out or crashes on PreToolUse doesn’t block the call, which carries on through the normal permission flow, and the default timeout is 600 seconds. Exit code 1 is a non-blocking error, so a policy script should exit 2 or return deny. Since v2.1.295, onFailure: "block" turns a crash or timeout into a block, and v2.1.312, from 27 October, was the latest release on 30 October 2026.²²⁰ The Claude Agent SDK works the other way round, and a PreToolUse callback that times out blocks the call.⁹ Its canUseTool callback never sees calls an allow rule or the permission mode already approved, so put the checks you rely on in a hook.¹⁰

This project settings file denies two things, asks before any tool from a payments MCP server, and sends every tool call to a policy service you run. The service replies with the same JSON a command hook prints, such as a "deny" decision with a reason Claude sees. If it is down, returns an error or takes more than five seconds, the call is blocked.

{
  "permissions": {
    "deny": ["Bash(git push *)", "Read(./.env)"],
    "ask": ["mcp__payments__*"]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "http",
            "url": "http://localhost:8080/policy/pre-tool-use",
            "timeout": 5,
            "onFailure": "block"
          }
        ]
      }
    ]
  }
}

Rules match the text Claude writes. Anthropic’s docs show a Bash(curl *) deny rule missing /usr/bin/curl and sh -c 'curl ...', and state that such a rule isn’t a security boundary around the program.⁸ The sandbox covers that gap for shell commands with a proxy that checks each host against an allowlist, though WebFetch, local MCP servers and hooks run outside it.²¹ The settings files that hold hooks can also be planted by an attacker, as our post on agent config files that run code shows.

OpenAI Agents SDK guardrails and tool approval

OpenAI’s Agents SDK has three mechanisms, and two of them act on tool calls.¹¹

• Input guardrails check the user’s message, in parallel with the agent by default, and the docs warn that the agent may already have executed tools when a tripwire stops it. run_in_parallel=False makes the guardrail finish first. Input guardrails run only for the first agent in a chain and output guardrails only for the last, so neither checks a tool call made after a handoff.
• Tool guardrails wrap function tools and can allow a call, replace its result with a message to the model, or halt the run. They don’t run for hosted tools such as web search, code interpreter and hosted MCP, for the shell, computer use and apply_patch tools, or for handoffs.
• Approvals pause the run. needs_approval takes True or a function of the parsed arguments, and a call with arguments the SDK can’t parse goes to manual approval. You approve or reject each pending interruption and resume from a stored RunState.¹²

Two details matter for anything that pays or sends. Approval doesn’t make a call run exactly once. If the process stops after the tool acts and before the state is saved, resuming can run it again, and OpenAI’s example is a payment, so it recommends an idempotency key that the destination enforces. The shell and apply_patch tools also need no approval unless you set needs_approval, and an always_approve decision for them can carry over to another agent’s shell after a handoff.¹²

The sketch below combines a hard ceiling, a review threshold and an idempotency key, written against v0.24.0 of the Python SDK, released on 15 October and still the latest on 30 October 2026.²² With pre_approval_tool_input_guardrails=True, the ceiling is checked before anyone is asked to approve, so no reviewer sees a refund the policy would refuse.¹¹

import json
from agents import (Agent, RunConfig, Runner, ToolExecutionConfig,
                    ToolGuardrailFunctionOutput, function_tool, tool_input_guardrail)
from agents.tool_context import ToolContext

CEILING_GBP = 500  # refused outright, whoever approves
REVIEW_GBP = 50    # a person approves anything above this

@tool_input_guardrail
def refund_ceiling(data):
    args = json.loads(data.context.tool_arguments or "{}")
    if float(args.get("amount_gbp", 0)) > CEILING_GBP:
        return ToolGuardrailFunctionOutput.reject_content(
            f"Refunds over £{CEILING_GBP} go to the finance team. Tell the customer.")
    return ToolGuardrailFunctionOutput.allow()

async def needs_review(_ctx, params, _call_id) -> bool:
    return float(params.get("amount_gbp", 0)) > REVIEW_GBP

@function_tool(needs_approval=needs_review, tool_input_guardrails=[refund_ceiling])
async def issue_refund(ctx: ToolContext, order_id: str, amount_gbp: float) -> str:
    """Refund part or all of an order."""
    # payments is your client; one key per tool call lets it drop a repeat
    return await payments.refund(order_id, amount_gbp, idempotency_key=ctx.tool_call_id)

async def main():
    agent = Agent(name="Support", tools=[issue_refund])
    config = RunConfig(tool_execution=ToolExecutionConfig(pre_approval_tool_input_guardrails=True))
    result = await Runner.run(agent, "Refund order 1042 in full", run_config=config)
    for item in result.interruptions:  # refunds waiting for a person
        print(item.name, item.arguments)

LangGraph interrupts and human approval for AI agent actions

LangChain’s HumanInTheLoopMiddleware, which runs on LangGraph, pauses before the tools you list and lets a reviewer approve, edit, reject or respond to each call.¹³ Since langchain 1.3.3, a when predicate can decide from the arguments, so a SELECT runs unattended while a DELETE waits. Paused runs live in a checkpointer, which the docs say should be a persistent one, such as Postgres, in production.

The docs flag two traps. A respond decision reaches the model as a successful tool result, so denying a side-effecting call with it reads as if the action happened, and reject is the decision for a denial. Heavy edits to the arguments can also make the model re-plan and call the tool again.¹³ LangGraph resumes an interrupted node from its first line, so a side effect placed before interrupt() repeats.²³ Our framework comparison covers where each framework keeps runs that wait days for an approval.

ToolCallLimitMiddleware caps calls per run and per thread. By default it blocks the extra call with an error message and lets the model carry on, so set exit_behavior="error" when the limit should stop the run.²⁴ Google’s ADK has a trap of its own. A before_tool_callback that returns any dict, even an empty one, skips the tool and hands that dict to the model as the result, so make the dict say the call was blocked and why.¹⁴

AI agent policy enforcement at the tool boundary

The MCP specification says a human should always be able to deny tool invocations, and that clients should show tool inputs to the user before calling a server. Servers must validate inputs, enforce access control and rate-limit tool calls, and clients must treat tool annotations as untrusted unless the server is trusted.²⁵ Enforcement is left to the server or a gateway in front of it. On an MCP server we built for a fashion commerce platform as part of our AI engineering work, third-party clients get the store’s assistant with its order-placing actions switched off, enforced on the server, as our write-up describes.

agentgateway, an Apache-licensed proxy for agent and MCP traffic, reached v1.7.0 on 27 October 2026.²⁶ Its mcpAuthorization rules allow tools by name, target server and the caller’s JWT claims, and remove denied tools from tools/list so the model never sees them. Those rules can’t read a call’s arguments.¹⁵ Its guardrail processors can, before the call is forwarded. Expression processors fail closed when the expression errors, and remote processors, which call a policy service you run, fail closed unless set to failOpen.¹⁶ Added to a route’s policies, this blocks email to outside domains and sends every other call to your service.

mcpGuardrails:
  processors:
  - kind: expression
    methods:
      tools/call: request
    condition: >-
      mcp.params.name == 'send_email' &&
      !(has(mcp.params.arguments) && has(mcp.params.arguments.to) &&
        mcp.params.arguments.to.endsWith('@example.com'))
    reject: "This agent can only email example.com addresses"
  - kind: remote
    host: "localhost:9001"
    failureMode: failClosed
    methods:
      tools/call: request

Policy in Amazon Bedrock AgentCore, generally available since 3 March 2026, checks every tool call through an AgentCore Gateway against Cedar policies. It denies by default, a forbid beats any permit, and conditions can use the caller’s identity and the call’s input parameters.²⁷¹⁷ Temporal policies, written in the Cedar-compatible Dogwood language, add conditions on the session’s history, such as a prior approval within a time window, a count of earlier calls or a running total.²⁸ In LOG_ONLY mode every call succeeds whatever the policies say, and anyone with bedrock-agentcore:UpdateGateway can switch a gateway to that mode or remove its policy engine.¹⁸

Copilot Studio can send each planned tool call, with its inputs, the planner’s reasoning and earlier tool outputs, to an external threat detection endpoint that answers allow or block.¹⁹ The endpoint has 1,000 ms. On a timeout or an error the tool runs, unless an admin sets the environment’s error behaviour to block. The feature is in preview, applies only under generative orchestration and is set up one environment at a time.¹ Microsoft Defender offers a managed version whose default rule only audits, while custom rules block four threat types, including secret exfiltration and email to unsafe domains, before the action runs.²⁹

Failure modes: workarounds, injected tool output, approval fatigue and latency

Agents route around a block. Each mechanism covers one route. A Claude Code deny rule matches command text, OpenAI’s tool guardrails skip the shell, and an MCP gateway sees only MCP. Our post on agents that work around limits shows Claude models finding another route when a tool refused them. Pair each per-tool rule with a control that covers every route, such as an egress allowlist or a credential that can’t do the forbidden thing.

Instructions arrive in tool output. A web page, an email or an API response can carry text that steers the next call. Anthropic treats tool output as an attack surface even when the tool is trusted, and its products route tool calls through proxies that can inspect results before the model sees them, using a small, fast classifier.³ OpenAI’s tool output guardrails, agentgateway’s response-phase processors and Defender’s checks on tool responses sit at the same point. Once an agent has read untrusted content, send its next payment or outbound message to a person.

Approval fatigue. Anthropic’s telemetry showed Claude Code users approved about 93% of permission prompts, and Anthropic says attention fell as the approvals piled up.³ Its OS-level sandbox cut prompts by 84%. Its auto mode classifier catches about 83% of overeager actions, so about 17% get through, and it blocks about 0.4% of harmless commands. These are Anthropic’s own figures. Ask people about fewer things, and show them the exact arguments, destination and amount.

Latency budgets. A synchronous check sits on every call it covers. As an assumption for scale, a model-based check that adds 700 ms to each of 40 tool calls adds 28 seconds to a task. Rules on names, arguments and counts cost far less, so run them on every call and keep model-based checks for calls that write, send or pay. OpenAI’s parallel input guardrails save that time at the cost of tools running before the check finishes.¹¹ Set every timeout to deny, or the check stops protecting you whenever the policy service is overloaded.

A policy design checklist

• Allowlist tools per task. Give each agent only the tools its task needs. A denylist fails on the first action nobody thought to list.
• Check parsed arguments. Validate recipients, domains, amounts, paths and SQL as structured values. Anthropic’s docs call argument patterns in Bash rules fragile.⁸
• Limit rates and spend. Cap calls and money per run, per session and per day, with running totals in your own store. AgentCore’s temporal policies and LangChain’s call-limit middleware help within their scope.
• Start in dry-run mode. Default each write path to a dry run that returns the exact request it would send, with live mode behind a server-side setting. 9io Alpha, our trading research platform, starts every order path in paper trading or a dry run, as our order safety post explains.
• Approve irreversible actions. Payments, messages, deletions, publishing, permission grants and deploys go to a person who sees the exact arguments, and the call carries an idempotency key.
• Make timeouts deny. Use onFailure: "block" in Claude Code, failClosed in agentgateway and the block setting in Copilot Studio.
• Build a kill switch. Keep one flag that every check reads on every call, plus a way to revoke the agent’s credentials and stop its sessions, and test it on a schedule. For high-risk systems, the EU AI Act asks for a stop button or similar procedure that brings the system to a halt in a safe state.³⁰
• Log every decision. Record each proposed call, the decision, the rule or person behind it, and the result. Run new rules in audit mode first, as Defender’s default rule and AgentCore’s LOG_ONLY mode allow.²⁹¹⁸
• Protect the policy. The agent’s identity must not be able to change its own rules. Keep UpdateGateway away from an AgentCore agent’s role. Claude Code treats .claude/ as a protected path that allow rules can’t pre-approve.³¹

What to block automatically and what to send to a person

Take the first line that fits.

1. The kill switch is on, or the check can’t decide because it errored, timed out or lacks data. Deny.
2. The action is outside the task’s allowlist, over a hard limit, or aimed at a destination the policy never allows. Deny automatically and return a reason the agent can report. Don’t queue it for a person, because asking people to approve what policy forbids teaches them to click yes.
3. The action can’t be undone, reaches outside your system, crosses a review threshold or follows untrusted content the agent read in this session. Payments, messages, deletions, publishing, permission grants and deploys all count. Pause for a person and show the exact arguments.
4. Anything else. Allow it, log it and review a sample each week.

Ask a person only when they can judge the action from what you show them. Anthropic makes the same point when it matches the strength of isolation to how well the user can oversee the agent.³ Track approval rates per action type as well. If reviewers approve a type almost every time, replace the approval with an automatic rule and a limit. A type they often reject points to a prompt or tool that keeps proposing the wrong thing, so deny it automatically while you fix the cause.

Frequently asked questions