Conduct’s maintainers claim its open-source guardrail layer can enforce and audit policies on LLM and MCP tool calls, providing agents with a deployable least-privilege control point.

state: expiredheat: lowuncertainty: highknownscott: lowagentic-security mcp agent-harnessesConduct

What is this?

Conduct is presented by its maintainers as an open-source guardrail layer that intercepts LLM and MCP tool calls, applies centralized policies, and records decisions for auditability and least-privilege enforcement. The repository’s earliest cited artifact is Sudhi Seshachala’s “Initial commit — Delegator v0.1,” after which the project was apparently renamed or reframed as Conduct. The supplied web snippets establish that gateway-level inspection, tool-argument validation, policy enforcement, and audit logging are recognized agent-security patterns, but they do not independently verify Conduct’s implementation or capabilities.

Why it matters to Scott

Scott already holds and implements this position in SiloOS and the deterministic agent control plane: consequential tool calls should pass through an independent, least-privilege, auditable enforcement boundary. Conduct is currently an unverified additional implementation in a category the radar already tracks through Bulwark Gateway, Grith, and Runbook.v1; absent evidence of a distinct enforcement mechanism or independently validated capability, it does not materially extend Scott’s architecture.

ip:framework.siloosip:concept.runtime-governanceip:framework.decision-authority-infrastructuredev:concept.deterministic-agent-control-planeradar:bulwark-agent-security-gatewayradar:grith-coding-agent-security-proxyradar:runbook-mcp-fail-closed-workflowsradar:concept.mcp-securityradar:concept.security-proxies

queries asked of Scott's wikis

least-privilege controls for coding agents
MCP tool-call policy enforcement
agent harness permission boundaries
auditable agent action logs
gateway versus harness-level guardrails
capability security for autonomous agents

Measured heat

no measured readings yet — the hourly heat pass fills this in

How the heat travelled

no chain yet — the hourly chain pass fills this in

Evidence (10) — ⭐ canonical anchor

source	object	author	score	comments
🟧 hn	Show HN: Conduct, open-source guardrails for LLM and MCP tool calls	sudhendra1	20	3
🟧 echo.github ⭐	The repository’s earliest primary artifact is Sudhi Seshachala’s “Initial commit — Delegator v0.1.” The project was later renamed/reframed a	Sudhi Seshachala	—	—
🟧 hn	Enterprise MCP Gateway: In-Flight PII Redaction and Audit in Go	BenjaminJ	1	0
🟧 hn	Steer: Deny or rewrite an AI agent's tool calls before they run	malucelli	2	0
🟧 hn	Agentic Trust Controls	mooreds	18	3
🟠 reddit	I gave Claude Code write access to my WordPress SEO fields. Here's what I built so it couldn't quietly wreck anything. ClaudeAI	NipunArora	0	3
🟧 hn	Two sentences our security scanner can't tell apart and how we solved it with ML	delphiaisec	1	0
🟧 hn	Show HN: A Proxy between LLMs and MCP servers with policy the model cannot reach	banuakman	2	0
🟧 hn	Jern Cloud – a coding agent bound by a policy file in your repository	ademar	1	0
🟧 hn	Show HN: Oconee Runtime – Policy enforcement for browser AI and coding agents	hthomas4	2	0

Interpretation history

2026-09-05T13:26:18Z
The stale review adds no Conduct-specific validation, adoption, or technical differentiation, and no concrete follow-up is expected. Earlier corroboration applied to the broader control-plane pattern, not Conduct’s claimed enforcement capabilities; this unvalidated implementation no longer warrants active tracking.
2026-09-03T12:30:04Z
Jern Cloud and Oconee Runtime further establish model-external policy enforcement as a recurring implementation pattern, but remain repetitive category evidence without adoption, technical differentiation, or validation of Conduct itself. The case stays corroborated at the category level and low-value to Scott’s already implemented architecture.
2026-09-03T12:22:30Z
evidence attached: hn.story.49548892 — This explicit browser and coding-agent policy runtime independently corroborates the move toward enforceable, auditable tool-call controls.
2026-09-03T12:22:30Z
evidence attached: hn.story.49548975 — A repository-bound policy file is an independent implementation signal for enforcing coding-agent actions beyond prompt-level controls.
2026-09-01T12:28:17Z
Extensible-MCP adds another independent, released implementation of model-external policy enforcement, making the broader tool-call control-plane pattern corroborated rather than merely observed. It still does not validate Conduct’s specific enforcement claims, establish adoption, or reveal a distinctive mechanism.
2026-09-01T12:23:47Z
evidence attached: hn.story.49520552 — This independent open-source MCP proxy corroborates the emerging pattern of deterministic policy enforcement outside the model while reducing exposed tool schemas and context overhead.
2026-08-31T19:42:50Z
The new examples broaden the category evidence for constrained writes, verification, and runtime monitoring, but neither independently validates Conduct nor establishes adoption or a distinctive enforcement mechanism. The case remains an inspectable implementation within an increasingly crowded pattern Scott already tracks.
2026-08-31T19:24:37Z
evidence attached: hn.story.49513690 — A runtime security sensor for AI agents provides relevant independent context on deployable controls beyond prompt-level defenses.
2026-08-31T18:27:13Z
evidence attached: reddit.post.1w3h53u — A concrete agent-facing plugin using constrained writes and read-back verification materially contextualizes deployable tool-call guardrails.
2026-08-31T15:41:09Z
The added “Agentic Trust Controls” listing is repetitive category evidence without technical detail, adoption, or independent validation; it neither strengthens Conduct’s specific claims nor changes the case’s meaning for Scott.
2026-08-31T15:25:23Z
evidence attached: hn.story.49510612 — This appears to be another agentic trust-control effort, but the sparse listing provides no evidence beyond the existing guardrail episode.
2026-08-31T03:29:42Z
Steer provides another independent implementation of pre-execution tool-call interception, strengthening the category-level pattern enough to move beyond a seed. It still does not validate Conduct’s enforcement claims, reveal a distinctive mechanism, or show adoption.
2026-08-31T03:23:23Z
evidence attached: hn.story.49505003 — A second released tool-call interception layer independently supports the emerging pattern of enforceable pre-execution agent guardrails.
2026-08-30T17:28:49Z
A separate MCP gateway adds category-level evidence that policy interception, PII redaction, and auditing are becoming concrete implementation patterns, but it does not validate Conduct’s claims or distinguish its mechanism. Conduct remains an inspectable yet unverified example in an already crowded control-plane category.
2026-08-30T17:24:12Z
evidence attached: hn.story.49500475 — This is a concrete MCP gateway artifact adding in-flight PII redaction and audit capabilities to the open tool-call-control episode.
2026-08-28T20:43:37Z
No substantive evidence has arrived beyond a one-point engagement increase; Conduct remains an inspectable but unvalidated implementation of an already familiar control-plane pattern.
2026-08-28T20:37:21Z
grounded: known/low — Scott already holds and implements this position in SiloOS and the deterministic agent control plane: consequential tool calls should pass through an independen
2026-08-28T20:34:37Z
origin walked (codex/luna, conf 0.97): anchor hn.story.49483173 -> echo.github.41c811fa90 by Sudhi Seshachala
2026-08-28T20:32:18Z
case created — A directly linked open-source repository makes this a concrete and inspectable agent-security release.

Decision trace

09-05 23:26expireThe stale review adds no Conduct-specific validation, adoption, or technical differentiation, and no concrete follow-up is expected. Earlier corroboration applied to the broader control-plane pattern,
09-05 23:26alert_silentThere is no new consequential delta or pending confirmation to justify interrupting Scott. Reopen on Conduct-specific enforcement tests, a distinctive mechanism, or meaningful deployment evidence—not
09-05 23:26alert_routeThere is no new consequential delta or pending confirmation to justify interrupting Scott. Reopen on Conduct-specific enforcement tests, a distinctive mechanism, or meaningful deployment evidence—not
09-03 22:30repriceJern Cloud and Oconee Runtime further establish model-external policy enforcement as a recurring implementation pattern, but remain repetitive category evidence without adoption, technical differentia
09-03 22:30alert_silentThe two releases add low-signal implementations to an already crowded pattern; neither shows a novel mechanism, validated capability, meaningful adoption, or an action-relevant change that would make
09-03 22:30alert_routeThe two releases add low-signal implementations to an already crowded pattern; neither shows a novel mechanism, validated capability, meaningful adoption, or an action-relevant change that would make
09-03 22:23alert_silentOconee Runtime and Jern Cloud are additional low-signal implementations of repository or runtime policy enforcement for agents, but the supplied evidence shows no distinct enforcement mechanism, valid
09-03 22:23alert_routeOconee Runtime and Jern Cloud are additional low-signal implementations of repository or runtime policy enforcement for agents, but the supplied evidence shows no distinct enforcement mechanism, valid
09-03 22:22attachThis explicit browser and coding-agent policy runtime independently corroborates the move toward enforceable, auditable tool-call controls.
09-03 22:22attachA repository-bound policy file is an independent implementation signal for enforcing coding-agent actions beyond prompt-level controls.
09-03 22:22propose_attachThis explicit browser and coding-agent policy runtime independently corroborates the move toward enforceable, auditable tool-call controls.
09-03 22:22propose_attachA repository-bound policy file is an independent implementation signal for enforcing coding-agent actions beyond prompt-level controls.
09-01 22:28repriceExtensible-MCP adds another independent, released implementation of model-external policy enforcement, making the broader tool-call control-plane pattern corroborated rather than merely observed. It s
09-01 22:28alert_silentThe new proxy is a concrete first-party release, but it reinforces an architecture Scott already implements and tracks; without independent validation, meaningful adoption, or a novel control mechanis
09-01 22:28alert_routeThe new proxy is a concrete first-party release, but it reinforces an architecture Scott already implements and tracks; without independent validation, meaningful adoption, or a novel control mechanis
09-01 22:24alert_silentA first-party founder post establishes that extensible-mcp is available as an Apache-2.0 self-hosted proxy with deterministic policy enforcement and on-demand tool discovery; its security and interope
09-01 22:24surface_candidateA first-party founder post establishes that extensible-mcp is available as an Apache-2.0 self-hosted proxy with deterministic policy enforcement and on-demand tool discovery; its security and interope
09-01 22:24alert_routeA first-party founder post establishes that extensible-mcp is available as an Apache-2.0 self-hosted proxy with deterministic policy enforcement and on-demand tool discovery; its security and interope
09-01 22:23attachThis independent open-source MCP proxy corroborates the emerging pattern of deterministic policy enforcement outside the model while reducing exposed tool schemas and context overhead.
09-01 22:22propose_attachThis independent open-source MCP proxy corroborates the emerging pattern of deterministic policy enforcement outside the model while reducing exposed tool schemas and context overhead.
09-01 05:42repriceThe new examples broaden the category evidence for constrained writes, verification, and runtime monitoring, but neither independently validates Conduct nor establishes adoption or a distinctive enfor
09-01 05:42alert_silentThe additions are adjacent implementation evidence without a validated capability advance, consequential adoption, or actionable security event; they can wait for the normal briefing.
09-01 05:42alert_routeThe additions are adjacent implementation evidence without a validated capability advance, consequential adoption, or actionable security event; they can wait for the normal briefing.
09-01 05:26alert_silentA vendor blog headline indicates an ML-based runtime security sensor for distinguishing semantically similar agent actions, but the supplied evidence contains no mechanism, evaluation, release artifac
09-01 05:26alert_routeA vendor blog headline indicates an ML-based runtime security sensor for distinguishing semantically similar agent actions, but the supplied evidence contains no mechanism, evaluation, release artifac
09-01 05:24attachA runtime security sensor for AI agents provides relevant independent context on deployable controls beyond prompt-level defenses.
09-01 05:24propose_attachA runtime security sensor for AI agents provides relevant independent context on deployable controls beyond prompt-level defenses.
09-01 04:28alert_silentA low-engagement self-report describes a potentially useful implementation pattern—database readback, hash-based compare-and-swap restoration, and fresh-state proof before modifying pre-existing conte
09-01 04:28surface_candidateA low-engagement self-report describes a potentially useful implementation pattern—database readback, hash-based compare-and-swap restoration, and fresh-state proof before modifying pre-existing conte
09-01 04:28alert_routeA low-engagement self-report describes a potentially useful implementation pattern—database readback, hash-based compare-and-swap restoration, and fresh-state proof before modifying pre-existing conte
09-01 04:27attachA concrete agent-facing plugin using constrained writes and read-back verification materially contextualizes deployable tool-call guardrails.
09-01 04:26propose_attachA concrete agent-facing plugin using constrained writes and read-back verification materially contextualizes deployable tool-call guardrails.
09-01 03:21sensor_dirtyengagement_update
09-01 02:21sensor_dirtyengagement_update
09-01 01:41repriceThe added “Agentic Trust Controls” listing is repetitive category evidence without technical detail, adoption, or independent validation; it neither strengthens Conduct’s specific claims nor changes t
09-01 01:41alert_silentThe new delta is only a sparse, lightly engaged listing that adds no identifiable mechanism or consequential implementation result beyond the guardrail pattern already tracked; it can wait for substan
09-01 01:41alert_routeThe new delta is only a sparse, lightly engaged listing that adds no identifiable mechanism or consequential implementation result beyond the guardrail pattern already tracked; it can wait for substan
09-01 01:25alert_silentThe new item is only a lightly engaged link titled “Agentic Trust Controls,” with no supplied technical detail establishing a distinct enforcement mechanism, deployable release, or independently valid
09-01 01:25alert_routeThe new item is only a lightly engaged link titled “Agentic Trust Controls,” with no supplied technical detail establishing a distinct enforcement mechanism, deployable release, or independently valid
09-01 01:25attachThis appears to be another agentic trust-control effort, but the sparse listing provides no evidence beyond the existing guardrail episode.