Summary
- Obsidian's Runtime Policy Decision Engine combines identity, permissions and customer-provided data classifications to evaluate AI agent actions.
- Its MCP Security Proxy checks supported tool calls before those actions reach connected third-party business applications.
- A Policy Decision API can extend the same decisions to customer-operated gateways, with human approval where supported.
Obsidian Security has introduced a runtime policy engine intended to control actions taken by AI agents across enterprise applications, coding environments and connected gateways, extending security enforcement beyond the initial decision to grant access.
The Runtime Policy Decision Engine, announced on 10 November, evaluates proposed actions using information about the person or identity behind an agent, the applications involved, its existing permissions and additional context supplied by the organisation.
Connected enforcement points can permit an action, block it or require human approval where that capability is supported. The decision is made when an agent attempts the action, rather than solely when its credentials are issued or its application connection is established.
Obsidian is combining that policy mechanism with an MCP Security Proxy and a Policy Decision API, allowing decisions to be enforced through supported integrations and customer-operated infrastructure.
The development reflects a problem associated with agents operating through legitimate enterprise identities. An agent may possess valid credentials and be authorised to use an application while still attempting an operation that exceeds the business purpose for which its access was provided.
Existing identity and access controls determine which resources an account can reach. Runtime policies add a separate decision concerning the operation the agent proposes to perform with that access.
Policy decisions use business context
Obsidian’s system combines available identity and application information with contextual data supplied by customers, such as classifications identifying particularly sensitive files or records.
A policy can consequently distinguish between actions involving ordinary information and those involving data assigned a higher sensitivity level. The system is designed to apply the same centrally managed rule at multiple supported enforcement points.
Employment information can also contribute to policy evaluation, allowing an organisation to make decisions based on the relationship between a user, their role and the resources the agent is attempting to access.
Those decisions depend on the quality of the underlying context. Inaccurate classifications, outdated permissions or incomplete identity records could affect the outcome, just as they affect conventional access-control systems.
Central policy management may reduce differences between rules configured separately in coding assistants, application gateways and workflow systems. It does not remove the need for each enforcement point to integrate correctly or to receive the information required for a reliable decision.
MCP proxy governs application tool calls
Model Context Protocol provides a standard way for AI clients to discover and use tools exposed by external services. An agent may use an MCP connection to search files, query databases or perform actions within business applications.
Obsidian’s new MCP Security Proxy sits between a supported AI client and the connected application. It identifies the user and application tenant, holds the application’s access token outside the AI client and evaluates tool calls before allowing them to reach the destination.
Keeping the application’s token within the proxy can reduce direct credential exposure to the client, although that protection depends on the connection being routed through the supported proxy arrangement.
The company identifies integrations involving applications such as Salesforce, Slack, Google Drive and Snowflake as examples of the environments in which MCP connections can expose business data.
Obsidian is also working with Cloudflare on using the proxy alongside Cloudflare’s MCP Server Portal. The companies describe the arrangement as combining gateway enforcement with contextual policy decisions.
The announcement does not establish universal compatibility with every MCP server or independently demonstrate that all supported actions can be intercepted under every deployment configuration.
Custom gateways receive policy decisions through an API
The Policy Decision API is intended for organisations operating their own AI gateways, workflow systems or agent execution frameworks.
Rather than recreating each rule inside those systems, a gateway can submit an action for evaluation and receive a decision with an explanation. The customer-operated enforcement point is then responsible for carrying out that result.
Obsidian has separately expanded runtime policy coverage for coding agents, adding OpenAI Codex alongside existing support for Claude Code and Cowork. The company’s wider discovery and governance functions cover agents embedded in enterprise platforms including Salesforce Agentforce, Databricks, Microsoft 365, ServiceNow and Workday.
Discovery and runtime enforcement should not be treated as interchangeable capabilities. Identifying an agent and mapping its permissions does not necessarily mean every action by that agent can be intercepted or blocked.
The distinction is particularly relevant where third-party applications introduce built-in AI functionality or modify available agent tools. Security teams may be able to discover such agents before runtime enforcement is supported for every operation they perform.
Obsidian has not published independently verified measurements demonstrating reductions in security incidents, false policy decisions or operational disruption from the new engine.
The product establishes a framework for applying contextual decisions across connected systems, with the effectiveness of those controls ultimately depending on integration coverage, policy quality and the authority of the systems enforcing the resulting decisions.
