System prompts are soft context, while your agent's API keys hold full write access to Stripe, Shopify, McLeod, and SAP. LockedAgents sits inline between your agent runtime and your production APIs to enforce caller-bound identity, cross-session velocity limits, and parameter bounds before any mutation executes.
Support, voice, and sourcing agents ingest untrusted external input and emit a proposed tool call (refunds.create, send_rate_con).
Verifies out-of-band caller authority, atomic sliding-window velocity, and parameter ceilings in real time before exchanging a short-lived token.
Shopify, Stripe, TMS, and ERP endpoints execute only policy-verified payloads, backed by an Ed25519-signed execution receipt.
If an agent's service account can issue a $20 appeasement credit or book an $1,800 spot load, that same API key can be manipulated into issuing a $240 returnless refund or signing a $3,200 rate confirmation. LockedAgents intercepts the outbound tool call outside the model context window.
Sierra, Intercom Fin, HappyRobot, LangGraph, or MCP client emits tool call.
Validates signed session JWTs, OAuth 2.0 On-Behalf-Of (act) claims, or Highway/ELD carrier identity outside the prompt so the LLM cannot spoof account ownership.
Maintains atomic counters across stateless LLM turns, tickets, and caller aliases to block 30/60/90-day split-refund farming and multi-call spot-rate fishing.
Inspects JSON tool arguments against versioned policy-as-code: returnless refund caps by net LTV, stepped buy-rate curves against DAT benchmarks, and accessorial locks.
Mints a cryptographic signature (X-LockedAgents-Signature) binding caller identity, chat/call hash, policy version, and executed payload for audits and chargebacks.
Signs scoped token and forwards mutation to Stripe, Shopify, McLeod, or SAP with audit header.
Never crashes the chat. Returns a structured tool_result instructing the bot to pivot to a return label or counter-offer.
Serializes tool_call_id state, triggers shopper OTP or pricing-desk Slack approval, and resumes on callback.
if statement in your tool wrapper or use an API gateway?
Single-request parameter checks work for static web forms. They break down the moment an autonomous agent loops across turns, channels, and shared service credentials.
| Production Failure Mode | Local Tool Wrapper (if amount > 50) / Stateless Gateway |
LockedAgents Inline PEP |
|---|---|---|
| Split-Transaction & Multi-Call Probing | Inspects one call in one process. Bypassed when a user opens five tickets for $49 credits or a carrier dials three times to fish your max buy rate. | Maintains atomic sliding-window counters across turns, tickets, voiceprints, and linked payment/MC identifiers. |
| Graceful Chat & Voice Recovery | Throwing an HTTP 403 or Python exception causes Sierra, Fin, or LLM tool loops to retry blindly, hallucinate, or freeze the customer conversation. | Injects deterministic synthetic tool_result instructions so the agent smoothly pivots to a prepaid return label or target rate counter. |
| Confused-Deputy & Shared API Keys | Downstream API sees only the agent's standing service account key. Prompt injection can trick the agent into mutating another customer's record. | Binds out-of-band caller JWT/OIDC tokens to target resource IDs and performs just-in-time OAuth On-Behalf-Of token exchange. |
| Async Human Approvals (HITL) | Holding an HTTP request open for a 20-minute Slack approval times out worker threads and corrupts the LLM tool_call_id state. |
Serializes execution state, emits a clean hold response, manages Slack/PagerDuty callbacks, and resumes the exact tool_call_id. |
| Policy Rollouts & Chargeback Proof | Rules are scattered across dozens of repos; changing a threshold requires a code deploy, and standard logs lack cryptographic dispute proof. | Evaluates candidate rules in read-only shadow mode against live traffic and signs Ed25519 execution receipts for Visa CE 3.0 & SOC 2 audits. |
Whether a shopper opens four chat tickets in 48 hours to farm appeasement credits or a freight dispatcher calls three times from different numbers to fish your max buy rate, LockedAgents correlates state across every turn and channel.
Account ownership, net LTV, and carrier Highway/ELD status are resolved from signed backend tokens and registries, never from untrusted chat text.
Track cumulative appeasements, DNR claims, and rate quotes across linked households, cards, and MC numbers with zero added conversational delay.
Hard-blocking an API call with a generic error crashes the agent loop and tanks your CSAT or booking conversion. LockedAgents rewrites out-of-bounds parameters or injects structured counter-offer instructions directly back into the agent.
When a cash refund breaches your returnless threshold, LockedAgents instructs your bot to offer a prepaid return label or bonus store credit instead.
Require instant SMS/email OTP before contact-detail edits or pause high-dollar exceptions for 1-click pricing-desk approval.
Deploy in read-only shadow mode in 15 minutes to see every unauthorized concession, rate leak, or policy bypass your agents are committing today, and generate dispute-ready cryptographic receipts when you go live.
Bind shopper session identity, device fingerprint, and explicit chat consent directly to the Stripe Charge ID to win friendly-fraud chargebacks.
Simulate tighter refund caps or stepped buy-rate curves against historical agent traffic to measure exact margin saved vs. escalation volume.
Stop wardrobers, serial DNR (Did Not Receive) claimants, and organized FTID refund rings from social-engineering your support bot into instant cash refunds and double reshipments. Inspect every outbound refunds.create and Shopify refundCreate mutation against net customer LTV and verified carrier weight scans, and require SMS OTP before email or address changes.
Stop dispatcher call centers and chameleon MCs from working your voice and email agents across multiple calls to burn your target rate. Enforce stepped escalation curves between your DAT/Greenscreens target and max buy rate, cap TONU, detention, and layover accessorials in code, and block rate con dispatch in your TMS until Highway status, ELD/cab-card VIN, and Verified Carrier email domain clear.
Accept orders and subscription upgrades initiated by external AI shopping and travel assistants without eating first-party fraud chargebacks (Visa 10.4 / Mastercard 4837). Verify pre-authorized spend caps and SKU refundability rules at checkout, and bind the buyer's signed mandate hash directly to your payment processor webhook for automated Visa Compelling Evidence 3.0 dispute defense.
Give sourcing and renewal agents the autonomy to close tail-spend deals without leaking your walk-away budget ceiling. Prevent suppliers from extracting reserve prices through iterative requoting, lock non-negotiable Net-45/60 payment terms and SLA liability caps at the API boundary, and route any counteroffer with unit-price creep to your category buyer before a PO is written.
Deploy LockedAgents in read-only shadow mode or run an offline audit on 100 anonymized support tickets or carrier negotiation transcripts. Zero impact on live traffic.