IBM contributes open-source controls for AI agents to Praxis

IBM has contributed a policy engine to the open-source Praxis proxy project, working with Red Hat to put security checks around AI-agent activity. Disclosed on November 9, the contribution lets teams apply rules to tools, prompts, model calls and other agents, using verified state outside the model’s control rather than leaving those decisions to the model.

IBM describes the work as a response to its own use of AI, where it wants the benefits without losing control of safety, security or costs. Praxis embeds the Praxis Policy Engine, or PPE, as a filter for both ordinary and AI traffic.

From internal rules to an enforcement point

The engine brings identity checks, delegated permissions, content controls and auditing into one enforcement pipeline. Teams can put strict access restrictions, broader behavior policies and domain-specific rules into a single policy specification. Its targets also include resources involved in a task.

PPE can sit at a central gateway, beside an agent or inside an application framework. IBM describes gateways as a layer above model-serving infrastructure, handling access, tool calls, parts of an agent’s workflow and token-use accounting for users or teams.

An upstream project with decision records

Praxis’s CNCF Sandbox acceptance vote passed on September 29. In its application, Red Hat said it intended to develop the project fully upstream as open-source software. IBM now says Praxis has been onboarded into the Sandbox and that IBM-affiliated contributors hold maintainer roles.

PPE already supports application-level enforcement, including Rosso Cortex’s laptop policy build, and has integrations with ContextForge and Mellea. It also uses verified agent identity to authorize delegated work and actions taken on someone else’s behalf, according to IBM.

For each policy decision, the engine can produce an audit record using the Open Cybersecurity Schema Framework, a vendor-neutral format for security data. Optional signatures and hash chaining let verifiers detect later changes to those records.

Next comes testing the boundaries

IBM is investigating how gateway enforcement can work with host isolation, which limits an agent’s access to local files, commands and subprocesses. A Praxis gateway could govern who invokes an agent, which remote tools and services it reaches, and what data crosses its boundary.

IBM plans to test how agents and their tools might bypass these controls. The research will assess which combinations of host isolation and network monitoring resist bypass while remaining usable and portable. For high-assurance settings, IBM also wants evidence that agents stay within their granted authority when calling tools or delegating work across computing and organizational boundaries.