Architecture
How Warden works.
Two phases. First you build an agent: give it instructions and grant it tools from your connected servers, and it’s saved. Then you run it: you talk to it, it loops with the model, and every action it takes passes one gate before it happens. Here is the whole path.
agent & tool flow
supporting wire
low-risk auto-run
The risk model
LOWReads, auto-run
Lookups, searches, file reads. No side effects, so the agent runs them on its own.
MEDReversible writes
Opening a ticket and the like. Runs automatically, but logged prominently.
HIGHIrreversible, gated
Moving money, writing files, creating PRs. Pauses for human approval before it runs.
Unrecognized tools default to HIGH. A tool from a server Warden has never seen is gated until a human decides otherwise, rather than trusted by default. Policies then layer on top of these tiers, spend caps, auto-approval thresholds, rate limits, and time windows, so the gate can escalate, relax below a threshold, or deny outright based on the actual arguments.
A run’s life
runningthe agent is reading and calling low/medium tools
awaiting approvala high-risk tool is held; a human must approve or deny
donethe agent finished; the full trace is in the audit log
Right now
5 server(s) connected exposing 58 governed tools:
Enterprise Tools (Warden) · 4 toolsFilesystem (Warden) · 3 toolsSelf-Audit (Warden) · 4 toolsDeepWiki (GitHub repos) · 3 toolsGitHub · 44 tools