Governance of artificial intelligence agents has become one of the most urgent challenges for companies seeking to scale their deployments. The dilemma is well-known: the more autonomous and capable an agent is, the harder it becomes to control its actions without limiting its usefulness. Brex, the US fintech company, has approached this problem from an unconventional angle: instead of writing security policies based on static rules or predefined permissions, they decided to observe what agents actually do in production and build their rules from that real behavior. The result is CrabTrap, an open-source HTTP/HTTPS proxy that intercepts all network traffic from agents and, combining static rules with an 'LLM-as-a-judge' system, decides in real time which requests to approve or deny.
The core idea is that the transport layer is an underutilized enforcement point. Every request an agent sends to an external API is an opportunity to inspect, reason, and apply a policy decision. Instead of relying solely on SDK-level guardrails, API tokens, or per-action permissions—solutions that often prove fragile against prompt injection attacks or overly limit capabilities—CrabTrap operates as a centralized point where all outbound communications converge. This makes it independent of the agent framework, programming language, or specific API being used.
What really sets Brex's approach apart is how they build policies. Rather than starting from a blank page and manually specifying which domains, HTTP methods, or request bodies are allowed, the team developed a 'policy builder' that works as an agentic loop. First, they run agents in shadow mode, analyzing historical traffic to identify patterns. Then, the system samples representative calls and automatically drafts a natural-language policy that mirrors the observed behavior. This draft is validated through an evaluation system that compares historical audit entries against the proposed policy, showing exactly what changes would occur. The process runs in minutes thanks to concurrent calls to the LLM judge, which only fires on less than 3% of requests—those falling outside known patterns or headed to unusual endpoints.
One of the major technical challenges they solved was latency. Placing a language model between the agent and every request could slow the system down. However, by restricting the LLM's intervention to a very small fraction of requests and using lightweight models like Claude Haiku, the performance impact turned out to be negligible. Moreover, the system benefits from the fact that agents, once in production, tend to establish predictable traffic patterns, which become static rules after being observed. Another critical issue was prompt injection into the LLM judge itself. Since the judge receives the full HTTP request—including URL, headers, and body—an attacker could manipulate those fields to alter the decision. The solution was to structure the request as a JSON object before sending it to the model, escaping all user-controlled content instead of interpolating it as raw text.
Internal results have been remarkable. According to Pedro Franceschi, co-founder and CEO of Brex, the most significant metric has been 'organizational confidence.' Before CrabTrap, the team hesitated to deploy autonomous agents in critical business areas for fear that existing guardrails would not provide sufficient assurance. Now they have a control layer that allows them to expand agent usage to more departments and delegate policy configuration to users themselves. Additionally, the proxy has revealed the enormous amount of unnecessary traffic agents generate: calls to unused APIs, redundant requests, or endpoints consuming time and tokens. This has allowed not only to fine-tune policies but also to optimize the agents themselves, removing entire tools that added no value.
The most important lesson for other companies is that infrastructure gaps should not become excuses to wait. Brex decided to build its own solution because the market did not offer a tool that met its needs. The approach of 'observe before regulate' can be applied to many other areas of artificial intelligence and cybersecurity. Instead of imposing blind restrictions, organizations can let agents—and users—first show how they work, and then adjust policies based on real data.
At Q2BSTUDIO we understand that every company has unique needs when integrating AI solutions into their processes. Brex's experience shows that agent governance is not a problem solved solely by technology, but by a strategy that combines observation, automation, and overlapping security layers. That is why we offer cybersecurity services and custom software development that help companies implement this type of control in a personalized way. Whether through intelligent proxies, dynamic policies, or integrations with cloud platforms like AWS or Azure, our team can work with you to design an agent governance system that adapts to your operational reality, rather than forcing your operations into a predefined mold.
The future of agent governance, as Brex points out, moves away from static SDK-level permissions and toward a centralized network control plane that learns from real behavior. CrabTrap is just the beginning. With the open-source community contributing, we will see features such as SSO authentication, role-based access control, escalation workflows for agents to request additional permissions, or even policies automatically generated from denial patterns. The philosophy of 'building in the open' allows these innovations to reach those who need them faster. The question every company should ask itself is not whether it needs a similar system, but when it will start observing itself to discover what rules it should have.
