The Arcjet Platform: Ingest, Observe, Enforce, and Audit

What is the Arcjet platform?

Arcjet is an AI agent runtime security platform. It finds the AI agents that run in your organization, records what they do, enforces policy on their prompts and tool calls, and keeps the decision evidence for audit. Arcjet works in four stages: ingest, observe, enforce, and audit. One policy engine, written in Rego, decides every enforced action and returns allow, hold, or block.

Arcjet covers three kinds of agent: coding agents such as Claude Code, Codex, and Cursor, custom agents that you build with the Arcjet SDKs, and agents that already run without your knowledge. The same platform also protects public web applications from bots and automated abuse.

Ingest: where Arcjet gets agent activity

The ingest stage is how agent activity reaches Arcjet. Arcjet accepts five kinds of source. Two of them sit in the path of an action and can stop it. The other three report activity after it happens, so they record and discover but can't block.

Start with the record-only sources to learn what's running, then add hooks or the SDK where you need enforcement. For more information about each source, see the Arcjet observe documentation.

Observe: what Arcjet does with agent activity

The observe stage turns raw agent events into an inventory and a history. Arcjet records every ingested event, including events that no policy evaluates. The observe stage includes the following capabilities:

• AI discovery finds the agents that run in your organization, including agents that nobody registered.
• Activity capture logs prompts, tool calls, and other lifecycle events for each agent session.
• Behavior analysis tracks how an agent's activity changes over time.
• Threat monitoring detects threats in real time, such as malware.
• Governance links each agent to the person or team that owns it.

Observation answers "which agents run here, who owns them, and what did they do?" It's the input you need before you write a policy, because a policy that blocks an unknown workflow causes outages.

Enforce: how Arcjet controls agent actions

The enforce stage applies controls at the points where an action can still be stopped. Arcjet groups its enforcement controls into five areas:

• Managed detectors screen text for prompt injection, personally identifiable information (PII), and secrets.
• Agent guardrails control which tools, MCP servers, and APIs an agent can use, and with which arguments.
• Threat analysis monitors the third-party APIs and MCP servers that an agent calls.
• Public web protection stops bots and automated abuse on your web applications, with the Arcjet Shield WAF.
• Content moderation applies policies to generated text and media.

Each control runs before the side effect. A coding agent hook adjudicates a tool call before the agent runs it. An SDK guard() call adjudicates an action before your code runs it. A control that runs after the action can record a violation, but it can't undo one. For more information about where to place controls, see AI agent security architecture.

How does the Arcjet policy engine decide?

The Arcjet policy engine evaluates every enforced action against the policies that you publish. Policies are written in Rego, the language of the Open Policy Agent (OPA) project, under a restricted Arcjet profile.

A decision has one of three outcomes:

• Allow: the action proceeds.
• Hold: the action waits for human review or approval.
• Block: the action doesn't run, and the agent receives the IDs of the rules that denied it.

When several policies apply to the same action, Arcjet runs all of them and returns the most restrictive result. Every rule can run in dry run first, so you can see what it would block against real traffic before it blocks anything. A policy that Arcjet can't read fails closed and denies the action.

Audit: where Arcjet decisions go

The audit stage keeps the evidence of what each agent did and what Arcjet decided. Every decision and every recorded event is available through the following destinations:

• Arcjet Console: agent mapping, inventory, and the activity feed for each agent.
• MCP server and API: manage policies and query decisions from your own tools or from a coding agent.
• SIEM log streaming: send decisions to Splunk, Datadog, Panther, and other SIEM tools.
• Analytics warehouse: store decisions in Arcjet cloud or in your own storage, with custom or zero data retention policies.

Audit records preserve the rule IDs that matched, so a reviewer can trace a blocked action to the exact policy that blocked it. For more information about the evidence that auditors ask for, see compliance evidence for AI agents.

How do you roll out the Arcjet platform?

Roll out Arcjet in the same order as the pipeline, so that each stage has the data it needs:

1. Connect a record-only source, such as OpenTelemetry or a provider compliance API, to find the agents that already run.
2. In the Arcjet Console, review the agent inventory and assign an owner to each agent.
3. Install coding agent hooks, or add a guard() call to your custom agent, at each action you want to control.
4. Publish a policy with its rules in dry run, and compare its decisions with real activity.
5. Promote the rules that behave as expected from dry run to live.
6. Stream decisions to your SIEM or analytics warehouse so that your security team can investigate them.

What Arcjet doesn't do

Arcjet enforces policy only where an agent asks before it acts. Activity from OpenTelemetry, provider compliance APIs, and shadow AI discovery arrives after the fact, so those sources can't stop an action.

Coding agents such as Claude Code fail open when a hook is slow or unreachable, so enforcement strength depends on Arcjet's availability and latency. In custom agents, your application chooses which policy to call and which actor identity to send, and Arcjet doesn't verify that your code runs the action only after Arcjet allows it. For more information about runtime controls, see AI agent runtime security.