Security Controls for AI Agents
Reins is a framework designed to enforce deterministic security policies on AI agent actions, ensuring that agents operate within predefined boundaries. The name draws inspiration from Greek mythology, where Athena provided Bellerophon with reins to control Pegasus. Similarly, Reins aims to provide control over AI agents, preventing unintended or harmful actions. It operates by integrating with agent frameworks such as Claude Code, OpenClaw, and any agent compatible with the Multi-Context Planning (MCP) architecture. The framework evaluates policies in under 50 milliseconds, ensuring minimal latency while maintaining security.
Developed by Pegasi AI, Reins was introduced in 2023 under the Apache 2.0 license, making it freely accessible for integration into existing systems. Its core functionality revolves around three primary actions: preventing unauthorized actions, pausing high-impact operations for approval, and maintaining an immutable audit trail of all decisions. These features collectively address critical security concerns in AI agent deployment, such as irreversible actions, risky system states, and compliance requirements.
The framework’s design emphasizes security guarantees through several key principles. First, it adheres to a Zero Trust model, where every action is evaluated before execution. Second, it operates synchronously, ensuring the agent cannot proceed until the security hook completes. Third, policies are cached locally to avoid network dependencies in the execution path, ensuring offline functionality. Fourth, any unhandled errors in the hook result in a fail-closed state, blocking the action by default. Finally, Reins maintains an immutable audit log in JSON Lines format, stored at ~/.openclaw/reins/decisions.jsonl, providing a tamper-proof record of all security-related decisions.
Reins integrates with popular AI agent frameworks through specific hooks. For Claude Code, it provides PreToolUse and PostToolUse hooks, allowing it to intervene before and after tool execution. For OpenClaw, it enforces security policies at the tool invocation stage, ensuring compliance with organizational policies. The framework’s compatibility extends to any agent following the MCP architecture, making it versatile for different deployment scenarios.
The framework’s security capabilities are further enhanced by its ability to scan configurations for vulnerabilities aligned with the OWASP ASVS (Application Security Verification Standard) Top 10 for AI systems. Additionally, Reins tracks drift over time, alerting administrators to deviations from established security policies.
Reins also introduces mechanisms to handle high-impact actions through approval workflows. For example, actions that could lead to catastrophic outcomes, such as bulk deletions or system modifications, are routed through terminal or messaging approval flows. These workflows require explicit CONFIRM tokens, adding an additional layer of verification before execution. This feature is particularly useful in environments where human oversight is necessary to prevent accidental or malicious actions. The framework’s design ensures that such approvals are logged alongside other decisions, maintaining transparency and accountability.
Recent releases, such as version 0.0.22 (April 2026), have introduced features like Watchtower scan artifact uploads and improved connectivity flows. These updates demonstrate Reins’ commitment to addressing real-world security challenges in AI agent operations.
Reins is implemented in Python and is distributed as a command-line interface (CLI) tool, making it accessible for integration into existing workflows. For Claude Code users, a dedicated skill is provided to integrate Reins directly into the agent’s security posture. This skill is installed in the ~/.claude/skills/reins/ directory, enabling seamless enforcement of security policies without disrupting the agent’s primary functionality.
How It Works
Reins operates by intercepting agent actions through predefined hooks, which are triggered before or after tool execution. For example, in Claude Code, the PreToolUse hook evaluates whether an action complies with security policies before the tool is invoked. If the action is deemed risky or non-compliant, Reins blocks it immediately. This pre-execution evaluation ensures that only authorized and safe actions proceed, reducing the risk of unintended consequences. The framework’s synchronous operation means the agent must wait for Reins’ evaluation to complete before continuing, preventing bypasses or race conditions.
The policy evaluation process is designed to be efficient, with decisions rendered in under 50 milliseconds. This speed is achieved through local policy caching, which eliminates the need for network calls during execution. Policies are defined in a structured format, allowing administrators to specify rules for allowed actions, required approvals, and irreversible operations. The framework supports both static and dynamic policies, enabling organizations to adapt their security posture as their needs evolve.
Reins also monitors the state of the agent’s environment, such as browser sessions or system configurations, to detect risky conditions. For example, if an agent attempts to execute a command in an elevated privilege context, Reins can identify this state and either block the action or require additional approvals. The framework’s ability to detect and respond to such conditions in real time enhances its effectiveness in dynamic and unpredictable environments.
The audit trail maintained by Reins is a critical component of its security model. Every decision—whether to allow, block, or pause an action—is recorded in an immutable JSON Lines log. The append-only nature of the log ensures that records cannot be altered retroactively, providing a reliable source of truth for audits and investigations.
This flexibility ensures that Reins can be adapted to a wide range of use cases, from small-scale agent deployments to enterprise-grade security infrastructures.
Use Cases
Reins is particularly valuable in environments where AI agents interact with sensitive systems or perform high-stakes operations. Reins can enforce policies to prevent unauthorized data access or modifications, ensuring compliance with data protection regulations. Reins can block destructive actions, such as bulk deletions or misconfigurations, before they are executed, reducing the risk of downtime or security breaches.
The framework’s ability to require explicit approvals for high-impact actions ensures that critical operations are reviewed by human operators before execution. Reins’ audit trail provides a clear record of all actions, which can be used to demonstrate compliance during audits or investigations.
Reins can monitor these interactions, blocking actions that could compromise the integrity of the research or violate ethical guidelines. The framework’s drift detection capabilities are particularly useful here, as they allow researchers to track changes in agent behavior over time and adjust policies accordingly.
For instance, an OpenClaw agent attempting to bulk-delete 4,382 Gmail messages would be intercepted by Reins before execution. The framework would evaluate the action against predefined policies, such as limits on bulk operations or restrictions on sensitive data. If the action violates these policies, Reins would block it, preventing potential data loss or misuse. This real-time enforcement is critical for maintaining security in environments where agents operate with high levels of autonomy.
Reins can enforce policies to prevent unauthorized changes, ensuring that only authorized personnel can modify sensitive information. The audit trail provides a clear history of all actions, which can be used to resolve disputes or investigate anomalies. This use case highlights Reins’ role in balancing automation with accountability, a key consideration in any AI-driven system.
Key Features and Capabilities
- Preventive Controls: Reins blocks destructive or non-compliant actions before they are executed. This includes scoring actions for irreversibility and detecting risky system states, such as elevated privileges or insecure configurations. By intervening at the pre-execution stage, Reins minimizes the potential impact of security incidents.
- Approval Workflows: High-impact actions are routed through approval flows, requiring explicit confirmation tokens before execution. This feature ensures that critical operations, such as system modifications or data deletions, are reviewed by authorized personnel. The framework supports both terminal-based and messaging approvals, accommodating different operational environments.
- Immutable Audit Trail: Every decision made by Reins is logged in an append-only JSON Lines format. The immutability of the log ensures that records cannot be altered, providing a reliable source for audits and investigations.
- OWASP ASVS Compliance Scanning: Reins scans configurations for vulnerabilities aligned with the OWASP ASVS Top 10 for AI systems. This proactive approach helps identify misconfigurations or insecure practices before they can be exploited. The scanning feature is integrated into the framework’s core functionality, ensuring that security checks are performed continuously.
- Drift Detection: Reins monitors agent behavior and environmental conditions over time, detecting deviations from established policies. This capability is essential for maintaining security in dynamic environments, where agent actions or system configurations may change unexpectedly. Drift detection allows administrators to adjust policies as needed, ensuring ongoing compliance and security.
- Zero Trust Architecture: Every action is evaluated against security policies before execution, adhering to the principle of Zero Trust. This model assumes that no action should be trusted by default, requiring explicit authorization for all operations.
- Offline Policy Enforcement: Policies are cached locally, eliminating the need for network calls during execution. This design ensures that Reins can enforce security controls even in offline or restricted environments. The fail-closed mechanism guarantees that any unhandled errors result in the action being blocked, preventing unintended execution.
- Multi-Framework Compatibility: Reins integrates with Claude Code, OpenClaw, and any agent following the MCP architecture. This compatibility ensures that organizations can deploy Reins across diverse agent ecosystems without requiring significant architectural changes. The framework’s modular design allows for easy adaptation to new or custom agent frameworks.
- This feature helps mitigate risks associated with malicious or misconfigured agents, ensuring that security policies are not bypassed through brute-force attempts.
- Watchtower Integration: Recent updates have introduced Watchtower scan artifact uploads, enabling centralized monitoring and analysis of security events.