The outbound decision firewall, defined (and live)
An outbound decision firewall is a pre-action gate that checks an AI agent's outbound quotes, customer replies, refunds, and posts against commercial policy before they execute, and returns one of four outcomes: allow, rewrite, require approval, or block, delivering a compliant rewrite when one exists. The phrase gets used to describe a product category that supposedly does not exist yet in turnkey form. It does. This page defines the category precisely and maps it, field by field, to a live API.
The shape of the thing
When people describe the missing "outbound decision firewall," they converge on the same response contract: a decision, machine-readable reasons, a compliant replacement when the action is fixable, an approver when a human must decide, and durable evidence. Written as JSON:
{
"decision": "allow | rewrite | require_approval | block",
"reasons": ["policy identifiers"],
"replacement": "compliant alternative or null",
"approver": "role or person",
"evidence": "versioned decision record"
}Here is that ideal contract mapped to EvalLayer's live response, from POST /authorize as it runs in production today:
| The ideal field | The live field | Notes |
|---|---|---|
decision | decision | Exactly the four outcomes: allow, rewrite, require_approval, block |
reasons | violations[] | Each with a rule identifier, severity, human-readable detail, and the offending excerpt |
replacement | approved_rewrite | Generated only when fixable, then re-checked against the policy before it is offered; null otherwise |
approver | approved_by | Stamped onto the record when a human resolves the approval queue, with timestamp and note |
evidence | record_hash + policy_version | Every decision is hash-chained to the agent's previous decision and ECDSA-signed; policies are stored and versioned, and the record names the version applied |
The four outcomes, precisely
- allow: the action complies; send it unchanged.
- rewrite: soft violations were found and fixed; a compliant alternative comes back, already re-validated, ready to send instead.
- require_approval: the action exceeds someone's authority (a discount, a dollar amount, a behavioral budget); it waits in a queue until a named human approves or rejects, and the resolution is stamped into the record.
- block: a hard violation (a forbidden commitment, a blocked topic); the action must not ship, and the record says exactly why.
One policy model across channels
The reason a single gate can span quotes, replies, refunds, and posts is that commercial risk is not channel-shaped. A policy declares limits: max_discount_pct, commitment_authority_usd, forbidden_commitments, approved_claims, required_disclaimers, blocked_topics, and behavioral budgets like cumulative committed dollars per customer per week. The action arrives typed (send_quote, send_reply, issue_refund, publish_content), but the same policy, stored and versioned, governs all of them. How to structure one is covered in writing commercial policies for AI agents.
What makes a firewall rather than a filter
Three properties separate a decision firewall from a content filter, developed further in guardrails vs authorization:
- It gates execution, not drafting. The check runs at the send boundary, before the refund fires or the reply ships, not as advice during composition.
- It can fix, not just refuse. The rewrite outcome returns a compliant alternative, which turns a large share of would-be blocks into shipped, correct actions.
- It remembers. Behavior rules read the agent's own decision history, so the fifth refund of the morning can be stopped even when each individual refund passes, and every decision leaves signed, chained evidence.
Try the category, live
The fastest way to evaluate whether this category is real: the live demo runs a quote email carrying three planted violations against an editable policy and returns the decision card in about two seconds, no signup. The authorization guide covers the mechanics underneath, and integration patterns exist for voice platforms, agent frameworks, and no-code stacks in the library.