Most companies are still debating whether agents should be allowed to book conference rooms. Brex gave them API keys and watched what they tried to break.
The Summary
- Brex built CrabTrap, an open-source HTTP/HTTPS proxy that intercepts every agent request and uses an LLM-as-a-judge to approve or deny actions in real time
- Traditional guardrails fail because each new agent capability means another API to tune, another permission to scope, another surface to audit
- The insight: agent governance belongs at the network layer, where you can see what agents actually do with credentials, not at the SDK level where you guess what they might do
The Signal
Brex's approach inverts the standard enterprise security playbook. Most companies build policy first, then figure out enforcement. Brex handed agents real credentials, API keys, OAuth tokens, service accounts, then watched the traffic logs to see what went wrong. CrabTrap came out of that empirical failure data.
The network layer angle is smart for a reason most security teams miss: it's the only enforcement point that sees the complete request context without needing to modify every tool or SDK. When an agent tries to call Stripe, or AWS, or your internal billing API, CrabTrap intercepts at the transport layer. Every HTTP request gets examined against policy rules. An LLM judges intent and risk. Approve or deny happens before the request reaches its target.
"Every request an agent makes is an opportunity to intercept, reason about, and make a policy decision."
This matters because the OpenClaw framework (one of the most widely adopted agentic systems) has a credential problem at enterprise scale. Agents need real access to be useful. Fine-grained API tokens help at the margins but get misused. Semantic guardrails like prompt steering get bypassed by prompt injection. Human-in-the-loop approvals kill velocity. The more capable you make an agent, the more dangerous it becomes. The safer you make it, the less useful it is.
Brex CEO Pedro Franceschi frames this as moving from SDK-level permissions and model guardrails to a centralized network control plane. That's a jargony way to say: stop trying to predict every bad thing an agent might do, and start watching what they actually try to do in production. The policy engine learns from real behavior, not hypothetical threat models.
Key design choices in CrabTrap:
- Open-source proxy, not a proprietary black box
- LLM-as-a-judge for context-aware decisions, not just regex pattern matching
- Sits between agents and the internet, captures all outbound traffic
- Policy enforcement happens at request time, not pre-deployment or post-incident
The "defanged agent" problem is real. Give an agent read-only access and it's mostly useless. Give it write access and it can delete your production database. The status quo forces a binary choice. CrabTrap tries to thread that needle with adaptive, per-request policy decisions based on what the agent is trying to accomplish in context.
The Implication
If you're building agents for production use, the SDK permission model won't scale. You'll end up with hundreds of scoped tokens, a million edge cases, and agents that can't do the thing you built them for. The network layer is the right enforcement point because it's downstream of intent but upstream of impact.
Watch for more companies to build similar control planes. The shift from "lock it down in code" to "watch it in flight and decide" is how enterprises will operationalize agents without waiting for frameworks to mature. Brex open-sourced CrabTrap, which means you can deploy this architecture today without building it from scratch.