Guardian agents for AI: ten questions to ask before you buy one
Gartner now has a market guide for guardian agents. Ten questions to put to any vendor, and why most of them come down to the laptop.
on this page
Key takeaways
- The category is new. Gartner published its first market guide for guardian agents in February 2026: AI that watches other AI and can allow, block, redirect or escalate what it does.
- Where it runs is most of the evaluation. Local models, MCP servers and keys in files only show up on the laptop.
- Test it live. Have every vendor stop a pasted secret in front of you, on a pilot machine.
- Ask for the export early. Every verdict should carry the policy version behind it.
Ask a CISO what AI their company runs and you'll usually get two answers. The official one is short: the enterprise ChatGPT tenant, Copilot, maybe Claude for legal. The other one is a shrug.
The shrug covers the coding agent a developer installed with Homebrew last Tuesday, the model someone pulled with Ollama to see what it could do, and the MCP server that gives an agent write access to the production database. None of it went through procurement, and most of it never touches your proxy.
In February 2026 Gartner gave the products built for this a name. Its first Market Guide for Guardian Agents covers AI that supervises other AI, and vendors from identity, network security and DLP have all picked up the label since. Below are the ten questions we'd put to any of them.
What a guardian agent is#
Gartner keeps it short: AI that watches what other AI tools and agents do, and when something crosses a line, lets it through, blocks it, redirects it or hands it to a person. It sits inside AI trust, risk and security management, somewhere between governance and runtime control.
What the definition doesn't say is where the guardian runs, and that's most of the evaluation. A browser extension sees the browser. A gateway sees what you route through it. An agent on the laptop sees the laptop.
Why the laptop is the hard part#
AI tools don't lean on the network the way SaaS did. Claude Code runs in a terminal under the developer's own login and reads whatever repository it was opened in. A model running in Ollama makes no outbound call at all. Most MCP servers run over stdio, as a local process, and they're declared in a JSON file such as ~/.cursor/mcp.json or claude_desktop_config.json, often with a token sitting right there in the env block.
Your CASB, your SWG and your SSO logs won't see any of that. Your endpoint sees all of it.
The ten questions#
We group them the way an evaluation tends to run: can it see, can it act, can it prove, and can you run it.
1. What does it see that never crosses the network?#
Get the list by name: desktop apps, coding agents, local models, browser extensions. Then ask how each one is found. If the answer is "from traffic", a local model won't show up. You want evidence from the machine itself: the install, the config, the account it's signed in with.
2. Does it find MCP servers, and the tokens next to them?#
Each MCP server gives an agent a way into a live system: GitHub, Jira, your Postgres. The product should list them per agent, say what each one connects to, and flag a token stored in plain text in the config. If the pitch is "route MCP through our gateway", push on the servers nobody routed.
3. Can it tell a personal account from a company one?#
ChatGPT on a corporate SSO login is a sanctioned tool. The same app on a personal Gmail login is a leak. Find out how the product tells them apart on the device, and whether it can show you who's signed in to which today.
4. Does it stop things, or report them?#
Have the vendor paste a test card number into ChatGPT on a pilot laptop, live. You're looking for warn, redact or block, on the machine, before the text goes anywhere. If the answer is a row in tomorrow's report, you're looking at monitoring.
5. What leaves the device?#
A guardian reads sensitive text by design, so get the data flow in writing. The matched secret or record should stay on the laptop. The console only needs to know a match happened and what was done about it.
6. Which actions wait for a person?#
Blocking a prompt is fine to automate. Uninstalling an app from an engineer's laptop without asking isn't, and the better products make an administrator approve it. Check which side of that line each rule sits on.
7. Does every verdict carry its policy version?#
Your auditor will ask why a laptop passed in March. The grade should point to the policy version in force that day, so changing a rule later doesn't quietly rewrite history.
8. Can you hand the record to an auditor?#
Find out which frameworks the rules map to (SOC 2, the EU AI Act, ISO/IEC 42001, the NIST AI RMF) and get a sample export before the pilot ends. If evidence takes a project every quarter, you'll stop collecting it.
9. How long to the first device, and how does it reach the fleet?#
Time it yourself, from download to first report. Check whether it needs admin rights and whether it ships as a package Intune or Jamf can push. If traffic has to go through a proxy first, add a quarter to the rollout.
10. Can it show what AI costs, by team?#
A tool that already reads usage on the device can put tokens and spend against people and teams. Finance tends to ask for this soon after rollout, so check it during the pilot.
Run the test on your own laptops#
A week on twenty of your own machines will tell you more than any deck.
How EndLayer answers them#
We built EndLayer around these questions, so here's where it stands, including where it stops.
Seeing (1 to 3). One agent, the Layer 1 Agent, runs on each laptop or server without admin rights. It reads 21 signals from the files AI tools leave behind: installed AI apps, coding agents, MCP servers, local models, browser AI extensions, accounts and provider keys. It never launches what it finds, and it reports every fifteen minutes. That's the Surface module.
Acting (4 to 6). Guardrails in the agent act on the device as it happens. Prompts are scored before they run, and secrets and personal data are warned on, redacted or blocked on the way out. The matched text never leaves the machine. Removing an installed app is the one action that waits for an administrator. That's the Govern module.
Proving (7 and 8). Nineteen versioned rules grade every device. Each failure gets an owner and a state, and each grade is tied to the policy version in force when it was taken. Rules map to SOC 2, the EU AI Act, ISO/IEC 42001 and the NIST AI RMF, and the record exports.
Running (9 and 10). The first device reports within sixty seconds of install, with no proxy or gateway in the path. The agent ships as signed packages for macOS, Windows and Linux, and Intune can push it as a Win32 package. Usage and cost by team sit in the Monitor module.
Where it stops. Detection needs the agent. If EndLayer isn't installed on a device, it can't see that device. We chose reading the machine directly over guessing from network traffic, and that's the cost.
Asked about this
What is a guardian agent for AI?
A guardian agent is AI that supervises other AI. It watches what AI tools and agents do and can allow an action, block it, redirect it or pass it to a person. Gartner places the category inside AI trust, risk and security management, as a blend of AI governance and runtime control, and published its first market guide for it in February 2026.
Why do guardian agents need to run on the endpoint?
Because much of the AI a company uses never crosses its network. Coding agents run on laptops with their own API keys, local models make no network calls at all, and MCP servers are declared in settings files on the machine. A guardian that only sits in a gateway or a proxy cannot see those tools, so it cannot govern them.
What should a guardian agent do when it finds a policy violation?
It should act where the AI runs, as it happens: warn the person, redact the sensitive part, or block the request before it leaves the machine. Some actions, like removing an installed app, are better held for a person to approve. Either way, every decision should be recorded against the policy version that made it.