Promtact sits in front of those calls and decides, per call, whether it happens: allow, hold for a human, or refuse.
It is a policy enforcement point for AI agent tool calls, plus the telemetry and audit trail needed to answer what did the agent do, and who let it afterwards. It speaks MCP, so it can be placed in front of an existing MCP server without changing the agent.
It contains no exploit logic and nothing that attacks a target.
The decision happens before the call, not after it. Detection that reports what an agent already did is a log, not a control. The cost is real and stated: every tool call has this service in its latency path.
Denial survives the database going down. If storage fails, decisions keep being made and are written to a local journal, then reconciled on recovery. An outage must not become an open door.
The operator is not exempt. Direct database access is announced before it is taken, observed independently through the database's own logs, and reconciled — a session nobody announced becomes a finding. The audit chain's head is published to a witness outside the host, so history cannot be rewritten unnoticed. See Security.
Each claim in technical-claims.md carries the command that checks it, and states its own limits. Where a control does not do something, that is written down next to what it does.