Put Guardian in front of the agent you already have.
If your agent calls tools, it can call them through NrtVix. The agent proposes an action; Guardian answers with a decision; the trusted gateway runs what is allowed.
NrtVix AI / Developers
Three steps to a guarded tool call.
- Step 1
Register an agent
Create an agent in your workspace and choose which tools it may use. The agent gets an identity, never a usable secret.
- Step 2
Call tools through Guardian
Use the guarded toolbox instead of calling your tools directly. Every call is validated, then proposed to Guardian.
- Step 3
Handle the decision
Read the status: executed, awaiting approval, or blocked. Tell your user the truth about what happened.
- Then
Resume after approval
When the owner approves, resume the same request by its id. It runs once, at the gateway.
from nrtvix import GuardedToolbox tools = GuardedToolbox(bridge) # your workspace + agent identity result = tools.call("refund_order", order="ORDER-1042", amount=180) if result.status == "executed": ... # done by the trusted gateway elif result.status == "awaiting_approval": ... # tell the customer it is with the owner else: ... # blocked or refused: do not retry
const res = await fetch(APP + "/api/m17/agents/" + agentId + "/chat/stream", { method: "POST", credentials: "include", headers: { "Content-Type": "application/json", "X-SaaS-CSRF": csrf }, body: JSON.stringify({ message: "Refund ORDER-1042 for $180" }), }); const reader = res.body.getReader(); // server-sent events over POST // event: delta -> text as the model writes it // event: tool -> one Guardian-checked tool result // event: done -> the final reply and all results
curl -X POST "$APP/api/m17/agents/$AGENT_ID/chat" \ -H "Content-Type: application/json" \ -H "X-SaaS-CSRF: $CSRF" -b cookies.txt \ -d '{"message": "Look up CUSTOMER-01"}' # {"reply": "...", "tool_results": [{"tool": "lookup_customer", # "status": "executed", "executed": true, ...}], "stopped": "completed"}
Preview. Everything on this page describes the current build. Names and paths may change before release, and the hosted API is not live yet. Documentation opens fully with early access.
One call. One clear status.
The same kind of request can end in different ways. Your agent reads the status and tells its user the truth about what happened.
executed: the gateway ran the action onceawaiting_approval: the owner decides; resume the same request afterwardsblocked: policy does not allow it, so do not retryalready_executed: a repeated request is never run twice
executed
Guardian check
Approval needed
A small surface. Strong guarantees.
Guarded tools
A fixed catalogue of tools with strict argument schemas. The agent cannot invent a tool.
One decision format
The same statuses for every tool, so your agent’s logic stays simple.
Streaming chat API
Replies arrive as server-sent events while the model writes, with tool results in between.
No secrets in your agent
Your agent holds an identity only. Tool credentials stay in the gateway.
Audit you can verify
An endpoint recomputes the audit hash chain for your workspace.
Local lab
Everything runs locally on sample data, so you can test safely before going live.
Four tools today. More on the way.
| Tool | Arguments | What it does | What Guardian checks |
|---|---|---|---|
lookup_customer | customer | Find a customer record by reference | Read-only |
refund_order | order, amount | Refund an order in US dollars | Amount limits, budget, approval |
add_support_note | ticket, note | Add a note of up to 500 characters to a ticket | Length limit |
export_customer_manifest | export, rows | Prepare a customer export of 1 to 1,000 rows | Row limits, approval |
What a tool call can return.
| Status | Meaning |
|---|---|
executed | The trusted gateway ran the action once. |
awaiting_approval | The request is in the owner’s queue. Nothing has happened yet. |
already_executed | This request was completed earlier; it is not run twice. |
blocked | Policy does not allow it. Do not retry. |
rejected | The owner said no. |
expired | The approval or permission ran out of time. |
invalid | The arguments were not acceptable. |
duplicate_refused | The same call was already made in this task. |
limit_reached | The task used all the tool calls it is allowed. |
Text as it is written. Results as they are decided.
| Event | Data | Meaning |
|---|---|---|
delta | {text} | Text as the model writes it. |
turn | {} | A new model turn starts after tool calls; earlier streamed text is only a preview. |
tool | {tool, status, executed, event_id, reason} | One Guardian-checked tool result. |
done | {reply, tool_results, pending_approvals, stopped} | The stored reply and all results. |
error | {detail, status} | The run could not finish. |
Sensible limits, stated up front.
| Limit | Value |
|---|---|
| Message length | 1 to 2,000 characters |
| Model turns per message | Up to 6 |
| Tool calls per message | Up to 4; duplicates are refused |
| Conversation memory | The last 8 turns, each capped in length |
| Business information | Up to 6,000 characters per agent |
| Messages per agent per day | 50 by default; configurable |
| Streamed response size | Capped; an unusable stream is asked once more without streaming |
Plain HTTP status codes.
| Status | Meaning |
|---|---|
401 | Not signed in. |
403 | Missing or wrong CSRF token, or a cross-site request. |
404 | The agent does not exist in your workspace. |
409 | The agent is archived. |
422 | The request body is not valid. |
429 | The daily message limit for this agent was reached. |
503 | The AI model is not configured on the server. |
Planned for developers.
Webhooks Planned
Be told when a request is approved, rejected or expires.
JavaScript SDK Planned
The guarded toolbox for Node.js and the browser.
API keys Planned
Scoped keys for the hosted API, rotated from the dashboard.
Versioned API Planned
Stable paths under a version prefix at launch.
Which models and frameworks work?
Any model or framework that can call a function. The hosted agent in the current build uses a large language model through its provider’s API; the SDK is model-agnostic.
Can my agent approve its own requests?
No. Approval is a separate, authenticated owner action bound to the exact request. An agent can only ask.
What happens if my agent retries a blocked call?
It is refused again. Repeated identical calls within a task are refused as duplicates, and blocked actions stay blocked.
When can I use the hosted API?
With early access, planned for December 2026. Until then the API runs only in the local build.
Let agents act. Keep control.
We are opening NrtVix AI to a small group of businesses first. Tell us about yours and we will be in touch.