Arcjet decides whether your agent may act. Your code still has to stop it. (2026)

"Put the decision where the action is."

That line sits at the top of Arcjet's product page, and it names the real problem well. A $12,000 refund and a $12 refund look identical at the network edge. By the time a gateway or a bot filter forms an opinion, the arguments that would have told them apart are already gone 1.

On September 17, 2026, Arcjet announced agent runtime security: a product that finds the agents running in production, decides whether each action may execute, and keeps the record afterwards 2. The company is a three-year-old developer security firm founded by David Mytton, with an $8.3 million Series A led by Plural and, by its own count, more than 500 production applications running its software 3.

The enforcement machinery is real engineering, and the documentation is unusually straight about where it stops. Three sentences from Arcjet's own docs and price list settle most of the buying decision, and none of them appear on the marketing page.

Two of the three pillars are older than the announcement

The launch is organised around three questions and three answers. Which agents are running (observe), should this particular action be allowed (enforce), and what happened and why (audit) 2.

Pillar	What Arcjet supplies	What your team still owns
Observe 4	Agent inventory and per-session activity, ingested with no code change through OpenTelemetry, the Claude Compliance API, or coding-agent hooks	Running at least one of those paths, and reading the list of actions that nothing enforced
Enforce 5	An ALLOW or DENY decision before the action runs, from versioned Rego policy over the inputs you map in	Calling the guard at every action boundary, and acting on the answer
Audit 2	Each decision stored with its policy revision and the values the policy read	Choosing where that evidence lives, and paying for the window you can read back

Two of those pillars existed before September. Arcjet shipped prompt injection detection in March 2026, Guards in April, and captcha-less bot signals in June, according to its blog archive 6. Guards was already "security inside the agent loop". What arrived on the seventeenth is the observation layer, the evidence layer, the packaging, and a price list.

That is not a criticism, it is a buying instruction. The part of this product that is new is the part you will judge on discovery and retention, not on whether a guard can refuse a tool call.

The framing Arcjet chose is worth holding onto. Its page promises "an import you ship this afternoon. Not a control plane to roll out," with no gateway, no proxy and no migration 1. Keep that sentence nearby, because the docs spend the next thousand words qualifying it.

Watching is not stopping

Activity reaches Arcjet three ways: coding agent hooks for Claude Code and GitHub Copilot, an OpenTelemetry exporter you already run, or one key pasted into the Claude Compliance API 4. No code change is needed for two of them.

Arcjet then says what that buys. "OpenTelemetry and Compliance API activity is context, not enforcement: it records what an agent did." And in the same document, describing its own activity view: "an action that appears in the activity with no decision beside it is an action nothing enforced. That gap is the point of the view." 4

Read as a product feature, that is a decent discovery workflow: the console shows you which tool calls nobody has wrapped yet, and you wrap them. Read as the pitch on the box, "tracks and controls AI agents in production," it is half a product. Only the coding-agent hooks path can also refuse a tool call without an SDK 4.

Arcjet agent activity feed — Arcjet's own activity feed, published in the September 17 launch post. Each row is a session: the tool that was called, a summary, and a conclusion such as EARLY_INJECTION_INT or EXFIL. Rows marked Clear were recorded, and nothing adjudicated them 2.

The fine print on that ingestion is where a security team will spend its week. Ingest is fire and forget, so a 200 means Arcjet received the export, not that it is queryable. Metrics are authenticated, acknowledged and not recorded. OpenTelemetry's gRPC port 4317 is not accepted. Arcjet warns against running more than one path at the same site, because each session lands twice under different identifiers with no way to correlate the copies; where hooks cover a team, the other paths belong on a separate site as a backstop 4.

The Claude Compliance API has its own exclusions. Nothing is retroactive, because Anthropic does not backfill. Claude Code authenticated with a Console API key, or run through Bedrock, Vertex AI or Microsoft Foundry, is invisible. So is Claude Code on the web, any organization with HIPAA readiness enabled, and any session under zero data retention. Thinking blocks, images and other binary content are absent, the system prompt is replaced by a marker, and tool inputs and results are truncated to 10,000 bytes each 4.

Then the data question, which Arcjet answers in the same breath. Two Anthropic credentials are accepted: a Compliance Access Key imports activity and session transcripts, an Admin API key imports activity only. And the documentation states plainly that "session transcripts carry raw prompts, source code, and any credential someone pasted into a session. Neither Anthropic nor Arcjet masks that content at ingest." On the OpenTelemetry path prompt and tool-detail capture is opt-in through two environment variables, which the docs tell you to leave unset if that content should not leave the machine. On the Compliance API path it arrives organization-wide with no per-client opt-in, which the docs themselves say is worth weighing before you connect it 4.

That is not a buried disclosure. It is a vendor telling you exactly what you are about to export. It is also the single fact that turns a one-line integration into a decision with a lawyer in the room, and no marketing page will raise it for you.

The decision comes back, the stopping stays in your code

Enforcement is the part that works the way the pitch says. You place a guard in the code path that takes the action: a tool handler, a queue consumer, a workflow step, no HTTP request involved. The guard returns a decision, and the action either runs or it does not 5.

Policy lives in two places by design. Rules in code sit next to the handler they protect, go through review, and can run in dry-run mode before anything blocks. Remote policies are written in Rego over Open Policy Agent, selected by a stable label, versioned and immutable, and changed from the console, the API, the CLI or an MCP server without a redeploy. The example Arcjet publishes for an email tool denies external recipients, denies bulk attachments, and applies injection detection when the tool is destructive 2.

Now the sentence to read twice. "The application owns the final enforcement point. A direct guard() call returns a decision for you to act on" 5. The launch post puts the same shape in different words: Arcjet returns the decision before the action executes, and your code can stop the operation, ask a human to approve it, or hand the agent an explanation 2.

That is the correct architecture, and it is also the workload. Coverage equals the number of call sites somebody remembered to wrap, and the enforcement is an if statement your team writes and maintains. A decision API that nothing consults is a log with better manners.

Arcjet Console detail view of a denied action — A denied action in Arcjet's console, from the launch post. The reason is "Recipient must be on the allow list"; the inputs show which values the policy read and where each came from, with `recipient` and `allowed_recipients` resolved in Arcjet's cloud and `body` evaluated by the local SDK 2.

The performance budget is published too. Arcjet quotes under 1ms of local decision overhead, 20 to 30ms when the cloud API is needed, and around 100ms for the prompt injection scanner, which runs ahead of the provider call 1. Integrations cover Claude Agent SDK, Claude Managed Agents, OpenAI Agents SDK, LangChain, LangGraph, CrewAI, Genkit, Google ADK, Mastra, Microsoft Agent Framework, Strands, TanStack AI and the Vercel AI SDK, alongside JavaScript, Python and Go SDKs; the Python and Go kits reached 1.0 with this release 1 3.

The evidence is the expensive part

The audit pillar carries the price list. Three plans, billed per app: Individual at $25 a month with one team member and one hour of log retention, Startup at $299 with two members and 24 hours, Growth at $799 with ten members and 30 days. Every plan starts with a 15-day trial 7.

Arcjet price page plan cards — Arcjet's price page, read on September 18, 2026: the three per-app plans and the retention each one buys. The top plan costs 32 times the entry plan, and the difference it is selling is how far back you can look 7.

On top of the subscription, the meters run. Any protect(), guard() or capture() SDK call counts as a request at $5 per million, with rate limits, filters and Shield WAF rules charged as one request. Prompt scanning is $2 per million tokens. PII detection is $1 per million requests, bot detection $0.50, advanced bot signals $2, email validation $1.50 per thousand, content moderation $0.20 per thousand text units. SAML single sign-on is $300 a month 7.

Two retention numbers coexist in Arcjet's own material, and buyers should read them as answering different questions. The price page sells one hour, 24 hours or 30 days of log retention. The privacy documentation says Arcjet "retains data for 30 days to provide historical analysis, and retains aggregated data for longer to give you insights into your application's traffic patterns", and adds that processing in a specific region is a paid add-on 8. The tier decides how long you can read the record; the vendor's copy decides how long it exists. Evidence can also be kept in a single-tenant or private VPC deployment, or in storage you manage, and Arcjet notes it is not a SIEM, so logs can be forwarded to your existing detection stack in real time 2.

The meter runs on the risk it is meant to contain

Here is the structural oddity. One of the four problems Arcjet lists for agent security is cost explosion: a runaway loop that burns a month of token budget in an afternoon. That loop is also the case that spins the meter hardest. Every extra action is another guard call at $5 per million requests, every scanned prompt is another million tokens billed at $2, and the budget rule that is supposed to stop the spending is itself a billed request 1 7.

That is insurance priced by the unit of fire. It is not dishonest, and per-request pricing is how a decision service with local overhead should probably be sold. It does mean the runaway agent is expensive in three places at once, and the teams most likely to hit that are the ones with the least instrumentation.

The second oddity is smaller and more consequential. The half of the product that requires no code change is the half that cannot block anything, and the half that blocks is the half that needs a wrapper at every action boundary. Arcjet says it is not a gateway, and it is right that a proxy cannot see the arguments about to be passed to a tool. What it cannot say is that the boundary is now yours: when an action goes out that should not have, the record will show a DENY the application did not act on, and Arcjet's own docs place that final enforcement point in your code 5.

Verdict

Take the free 15-day trial if your team already calls tools from LangChain, LangGraph, the OpenAI Agents SDK or the Claude Agent SDK and a security reviewer is asking what your agents did last week, because the enforcement primitive is genuinely better placed than a network control, Rego policies that a security team can tighten without waiting for a release are a real answer to a real bottleneck, and the in-process PII check keeps the raw string inside your own environment. Go in knowing you will write an if at every tool that moves money, sends mail or exports data, and that the useful audit window costs $799 a month per app. Leave it alone if you wanted a switch to flip over agents you have not instrumented, and do not connect the Claude Compliance API to an organization-wide key until someone has decided, in writing, that raw prompts, source code and any credential a colleague pasted into a session may leave the building. Arcjet's docs say nothing masks them at ingest. Believe them.