Question 1

Does Constrix add latency to my AI system?

Accepted Answer

P50 evaluation latency is under 5ms. P99 is under 25ms. Kill decisions complete in under 2ms. For the vast majority of AI workloads, the governance overhead is imperceptible. For cases where it is perceptible, the question becomes: can you afford the alternative? One ungoverned AI decision — a failed audit, a regulatory fine, an incident — will cost far more than 5ms.

Question 2

Can we bypass Constrix in an emergency?

Accepted Answer

No. Non-bypassable is a structural property, not a configuration option. There is no emergency override, no admin flag, and no API call that skips evaluation. This is not a limitation. It is the point. A governance layer you can bypass under pressure is not a governance layer.

Question 3

What happens if Constrix goes down?

Accepted Answer

Constrix fails closed. If the evaluation pipeline cannot complete an evaluation, the default decision is deny. The AI system stops — it does not continue silently without governance. We maintain a 99.99% uptime SLA at the Enterprise tier. Status at status.constrix.ai.

Question 4

We already have an AI gateway / LLM proxy. Why do we need Constrix?

Accepted Answer

Most AI gateways govern access to models — which model a user can call, at what rate, at what cost. Constrix governs decisions — what the automated system is permitted to do, with cryptographic proof that governance happened. They are two different layers in the same stack. Constrix typically sits between your orchestrator and your AI gateway, not as a replacement.

Question 5

Does Constrix work with multi-agent systems?

Accepted Answer

Yes. Constrix governs at the boundary — every tool call, every MCP invocation, every external action — regardless of which orchestrator or swarm architecture runs internally. Systems built on SwarmSOC, LangGraph, AutoGen, CrewAI, and any MCP-compatible framework can be governed by Constrix without modifying their internal architecture.

Question 6

What is a ghost agent and why should I care?

Accepted Answer

A ghost agent is one that still holds live credentials but has stopped generating governed activity in Constrix. It is the agentic equivalent of an employee who left two years ago and still has badge access — except the agent runs 24/7 and nobody notices.

Constrix detects ghost agents using the CAPL audit record as an activity signal. When an agent's last sealed evaluation is older than your configured dormancy threshold (default: 14 days), Constrix alerts the owner, escalates, then auto-revokes. Revocation propagates globally in under 500ms. The entire lifecycle event is sealed in CAPL.

No other platform can detect ghosts this way. No other platform has the sealed activity record.

Question 7

Do I need to change my agent code to use AgentID?

Accepted Answer

Your agent needs to request an Agent Identity Token (AIT) on boot and include it in evaluation request headers. The Constrix SDK handles this automatically — one configuration change, no code rewrite.

AIT verification in constrix-proxy is internal and offline. It adds under 1ms to evaluation latency. The private key never leaves your agent. The token auto-renews before expiry.

Question 8

What is a delegation chain and when does it matter?

Accepted Answer

When an orchestrator agent instructs a sub-agent, the sub-agent's identity token records that delegation — who directed it, at what depth in the chain, with what scope. The full chain is embedded in every CAPL record the sub-agent creates.

This matters when an incident occurs in a multi-agent system and you need to trace which human authorized the chain of actions that led to it. The delegation chain gives you that trace — cryptographically sealed, independently verifiable, in the audit record that already exists.

Question 9

How does AgentID interact with our existing IAM or identity provider?

Accepted Answer

AgentID does not replace your existing IAM. It governs the layer your existing IAM was never built to handle: non-human identities operating at machine speed, with ephemeral credentials, in autonomous multi-step workflows.

AgentID complements Okta, Azure AD, AWS IAM — the human identity layer stays unchanged. AgentID governs the agent identity layer beneath it, producing a sealed activity record that has no equivalent in your existing IAM architecture.

Start for free. Scale with proof.

Free

Starter

Pro

Enterprise

Frequently Asked Questions