Introducing Composio Firewall

The biggest issue in agentic software is trust.

Models can already do much of the work we want to delegate. They can read documents, use tools, and act across applications. But giving an agent the ability to do something does not mean we should trust it to do that thing in every context.

Trust requires boundaries. An agent needs to act within the task the user actually requested and the limits the developer and user have set. It also needs protection from outside content that tries to redirect its work.

Today, we're introducing Composio Firewall, the runtime boundary for agentic software.

Permissions don't capture intent

In traditional software, developers define the expected execution paths ahead of time. With agents, the model decides which actions to take as the task unfolds. Those decisions depend on information the developer may never have seen, including emails, documents, and tool results retrieved during execution.

Consider an agent asked to review vendor invoices. It might need permission to read email and access business records. Those permissions alone cannot tell you whether a particular action belongs to the task.

An email could contain an instruction to export customer contacts to an outside address. The agent might have the tools and credentials to do that. The user still never asked it to.

This is where security, alignment, and safety meet. An action can be technically permitted and still violate the user's intent. Boundaries need to account for what the agent is doing at runtime, not only what it was allowed to access at setup.

Checking both sides of a tool call

Millions of users and developers already use Composio as the runtime for their agents, with tools, authentication, and sandboxed execution.

Composio Firewall strengthens that existing boundary in both directions. It checks the actions agents take through Composio and the information coming back to them.

Every action an agent takes through Composio is evaluated using Jev and custom small language models tuned by Composio on real-world usage data. The firewall checks whether the action respects user intent and the boundaries set by the developer and user before execution.

Incoming information needs scrutiny too. Agents routinely read content written by people who have no authority to direct them. A retrieved page or an email can carry instructions designed to make the agent abandon its task, disclose information, or take an unauthorized action.

The firewall checks tool results before they reach the agent and blocks results carrying malicious instructions. This helps protect against prompt injection at the point where outside information enters the agent's context. Checking returned content does not undo an action that has already run, which is why checks before execution matter too.

Delegation needs runtime enforcement

A useful agent needs enough access to complete its work. Restrict it too heavily and it cannot do the job. Give it access without checking how that access is used, and every new task asks the user to accept more risk.

Runtime enforcement makes those boundaries part of execution. The agent's proposed actions can be evaluated against the user's task, while incoming content is checked for attempts to redirect it.

No safety layer eliminates every risk. Composio Firewall adds a runtime check where agents interact with tools and outside information, helping developers enforce the limits that make delegation trustworthy.

Composio Firewall is live now for all Composio developers. Developer pricing is available on our pricing page.

Explore Composio Firewall.