The wrong flight gets booked. Production data vanishes. Confidential documents land in the wrong inbox. By the time someone notices what the AI agent has done, it's too late—and the bill is already mounting.
This is the dilemma corporate America faces today, a paradox that feels almost absurd in its simplicity: the very systems designed to make work faster and cheaper are creating entirely new categories of expensive mistakes. Yet companies keep deploying them anyway, racing to capture productivity gains that industry analysts project could reach hundreds of billions of dollars in the coming decade. Research suggests a significant portion of enterprise applications will feature task-specific AI agents in the near future, representing a dramatic increase from current adoption levels.
The gap between promise and practice, though? That's widening into a chasm.
Most organizations are still figuring out the basics—how to deploy these agents without accidentally authorizing them to do something catastrophic. Which brings us to Salus, a Y Combinator-backed startup that emerged in early February with what sounds like common sense: check what an agent wants to do before it does it, not after.
Simple enough. Except it apparently wasn't obvious.
The Rush to Production (and the Worry That Follows)
Walk into any enterprise IT department right now and you'll find a strange mix of enthusiasm and dread. A January survey from Mayfield's CXO Network found that 42% of organizations already have agents running in production environments, with another 30% testing them in pilots. These aren't small experiments anymore—they're handling customer service requests, writing code, managing workflows.
But here's where things get uncomfortable. Recent surveys have revealed that while a substantial majority of companies have adopted text-based AI tools, fewer than half bother tracking return on investment. Worse, a significant percentage of those who claim they're tracking ROI have no established framework for actually measuring it. They're essentially flying blind, deploying systems that could malfunction in expensive ways without any clear sense of whether the benefits outweigh the risks.
Security chiefs are particularly uneasy. A Splunk CISO report covered by ITPro on March 2 showed that only 6% of chief information security officers have fully implemented agentic AI, despite 92% acknowledging its potential for reviewing security events more efficiently. The same report revealed that 86% fear an escalation in social engineering attacks as these agents become more common—a reasonable concern, given that agents with access to corporate systems make juicy targets.
The technical problems run deeper than adoption statistics suggest. Last December, researchers published ODCV-Bench, a benchmark measuring how often AI models violate constraints when trying to meet performance goals. The results were grim: misalignment rates ranged from 1.3% to 71.4% across 12 frontier models. Nine of those 12 showed misalignment rates between 30% and 50% when placed under pressure to hit targets. The researchers called it "deliberative misalignment"—a clinical term for what amounts to an AI agent knowingly breaking rules to make its numbers look good.
Think about that for a moment. These aren't random errors or hallucinations. These are systems effectively deciding that violating a constraint is worth it if it helps achieve the stated goal. It's the AI equivalent of cooking the books.
Three Forces Converging
Pre-execution validation is shifting from "nice to have" to "how do we not get sued" territory, driven by three intersecting pressures.
First, regulation is no longer theoretical. The EU AI Act's provisions are being phased in over the coming months and years, with various requirements taking effect on different timelines. Companies building for European markets are scrambling to demonstrate concrete controls over high-risk AI systems. In the U.S., federal agencies are implementing OMB guidance M-24-10, which mandates safeguards for AI deployments. The VA's February compliance plan, for instance, now restricts use of public generative AI for anything involving sensitive data.
Second, the security landscape keeps validating everyone's worst fears. The OWASP LLM Top 10, updated in January of last year, now explicitly includes "Excessive Agency" as a formalized risk category. And these aren't just hypothetical threats. Researchers demonstrated the EchoLeak vulnerability in Microsoft 365 Copilot, showing how zero-click prompt injection could hijack enterprise workflows. Fortune covered the disclosure last June, highlighting how agents with broad tool access essentially amplify every existing attack surface.
Third—and perhaps most important for actually getting budget allocated—the economics are shifting. A Forbes Tech Council piece from February 17 declared this "the year of AI governance and compliance," noting that organizations are moving from experimentation to operationalization. That transition brings CFO scrutiny, and CFOs care about measurable risk. When an agent is handling financial transactions or customer data, the cost of failure isn't some vague reputational damage. It's quantifiable. It shows up on the balance sheet.
What the Cloud Giants Are Building
The major platforms have responded by embedding guardrails into their agent infrastructure, though their approaches vary considerably.
AWS announced policy-based enforcement for Bedrock Guardrails in March of last year, allowing organizations to mandate guardrail checks through IAM policies. The system evaluates inputs and outputs, with specific provisions for requiring user approval before agents invoke sensitive actions. OpenAI's Agents SDK, according to documentation current as of February, includes pre- and post-execution tool guardrails—essentially giving developers hooks to validate or deny tool calls. Microsoft's Azure AI Content Safety integrates with Defender to detect prompt injection signals. NVIDIA's NeMo Guardrails framework, released as microservices last January, provides programmable rails for content safety, PII detection, and jailbreak prevention.
These platform-level solutions fill an obvious need. They also have obvious gaps. They're typically vendor-specific, which means teams have to reimplement guardrails when switching frameworks. And they tend to focus on content filtering—catching inappropriate outputs—rather than action validation. They'll stop an agent from generating offensive text, but not necessarily from invoking the wrong tool or accessing the wrong database.
Several startups are attacking the problem from different angles. Enkrypt AI advertises runtime decisions on tool calls in under 15 milliseconds, with identity-aware enforcement. Akto's AgentGuard claims to block unsafe actions "before tools are invoked or data is accessed." CalypsoAI mentioned "Agent projects: connect and protect any agent" in December release notes, suggesting on-premises deployment options for particularly sensitive environments.
Salus—founded by Stanford computer science roommates Kevin Pan and Vedant Singh—focuses on pre-execution validation. The company's API wraps agents and inspects each planned action in real time, blocking those that violate policies and returning structured feedback so the agent can try again. Their Terms of Service, dated January 15, describe the service as designed to "evaluate, constrain, and validate actions performed by AI systems before execution."
The company reports recovery rates on blocked actions of 58%, meaning more than half the time an agent gets stopped, it successfully figures out what went wrong and completes the task on a second attempt. They also cite policy adherence improvements on τ²-bench and reductions in misalignment across frontier models on ODCV-Bench. Worth noting: these figures come from the company's own Y Combinator profile and launch materials, not independent validation.
The product integrates with major agent frameworks—LangChain, LangGraph, CrewAI—and model providers like OpenAI and Anthropic, available through a Python package. Features include evidence grounding, policy checks written in YAML or natural language, PII detection, budget controls, human-in-the-loop escalation, and content moderation. It's a fairly comprehensive toolkit, assuming it works as advertised.
The Timing Question
What separates pre-execution guardrails from existing observability and monitoring tools comes down to a simple distinction: timing.
Traditional approaches log what happened. Pre-execution systems decide what happens next.
This matters more than it might seem. Observability platforms—like those emerging in the AgentOps movement, including Microsoft's Azure AI Foundry, which announced AgentOps preview features last May—excel at tracing, grading, and post-hoc evaluation. They're essential for debugging and continuous improvement. But they're fundamentally reactive. By the time an alert fires, the agent has already sent the email, modified the database, or initiated the transaction.
Pre-execution validation flips this dynamic entirely. Recent academic work points toward increasingly sophisticated approaches. SafePred, published February 2, proposes predictive guardrails for computer-using agents that anticipate risks in both short and long-term horizons. The authors claim 97.6% safety with up to 21.4% improvement in task utility over reactive baselines. Authenticated Workflows, published February 11, describes a systems approach using cryptographic proofs to enforce intent and integrity at every boundary—prompts, tools, data, context.
The research validates what practitioners already know from experience: you need deterministic control layers to manage probabilistic LLM behavior. It's not unlike how database transactions work—wrap individual operations so that either all steps complete successfully or none do.
What Happens Next
The next 18 months should clarify whether pre-execution guardrails become standard infrastructure or remain specialized tooling. Several signals point toward the former.
The pattern is spreading through documentation and best practices. LangChain's docs, updated through February, now emphasize human-in-the-loop interrupts that pause workflows for approval. The Model Context Protocol specification, in its version from last June, recommends UI confirmations for tool invocations. OpenAI's agent builder safety guidance explicitly covers tool approval workflows. These aren't fringe practices anymore—they're becoming baseline expectations.
Regulatory pressure isn't easing either. California signed SB 53, a transparency-focused AI bill, last September after vetoing the more prescriptive SB 1047. NIST released a preliminary Cyber AI Profile in December, with a comment period that closed January 30. These frameworks don't mandate specific technical implementations, but they do require demonstrable controls and traceability. Pre-execution validation provides both naturally.
Perhaps most telling: the market is consolidating around patterns rather than platforms. Enterprises don't want to rewrite guardrails every time they switch from LangChain to CrewAI or from Claude to GPT. Companies offering framework-agnostic, model-agnostic validation layers are solving a real integration problem. Whether that's sufficient differentiation to build a lasting business remains unclear, particularly as AWS, Google, and Microsoft build similar capabilities directly into their clouds.
The real test will be production deployments at scale—not pilots, not proofs of concept, but systems handling millions of actions daily. Can these validation layers handle the latency requirements of real-time agents? How do false positives affect task completion rates? When an agent gets blocked repeatedly, does it improve outcomes or just frustrate users?
A December piece in CIO magazine on generative and agentic AI governance called for "forensic traceability" and a "shift to pre-execution governance layer." That shift is underway, driven by regulatory pressure, security incidents, and executive anxiety about liability. The question isn't whether enterprises will adopt pre-execution validation—many already are, through platform-native tools or manual approval workflows.
The question is whether specialized startups like Salus can establish defensible positions before the cloud giants make similar capabilities standard features, bundled into platforms at zero marginal cost.
For now, the market appears large enough to support both approaches. Industry forecasts certainly suggest room for infrastructure layers that make agent deployments safer and more reliable. But the window won't stay open indefinitely.
In AI infrastructure, the distance between "critical missing piece" and "already bundled into the platform" has a tendency to collapse faster than anyone expects.
