In-Process Runtime Governance: Enforce Before the Prompt Leaves the Process

There are three places you can govern an AI agent: in a dashboard after the fact, in a proxy on the network path, or inside the process, before the call is made. Only the third can truthfully say: the prompt that violated policy never left the machine. That sentence — not a latency benchmark — is why in-process is the architecture regulated industries end up needing.

Gartner's AI TRiSM framework (AI Trust, Risk and Security Management) makes the same point structurally: governance has to be operationalized as runtime controls embedded in the AI lifecycle, not documented as policy PDFs — and Gartner predicts organizations that operationalize AI TRiSM see materially better AI adoption and business outcomes by 2026. A control that observes a violation after the packet left is telemetry; a control that prevents it is governance.

What "in-process" means concretely

InferenceFort loads a signed policy bundle into the agent's process and evaluates every LLM call and tool call locally, before execution:

• Model-access policy, content rules, PHI detection — evaluated on the assembled prompt, in memory, with no hot-path network round-trip. A block costs microseconds, not a proxy hop.
• Egress / data-residency — the call's resolved destination is checked against the tenant's approved endpoints before connect. A prompt bound for a non-approved region is stopped while it is still bytes in RAM — the enforcement point GDPR Chapter V data-transfer rules actually want, since a transfer that never happened needs no legal basis.
• PHI redaction — HIPAA Safe Harbor identifiers are redacted before the model sees the text, aligned with the HHS de-identification standard. A proxy that redacts has, by definition, already received the PHI; in-process redaction means the unredacted text never crosses a trust boundary at all.
• The action layer — tool and MCP calls are governed the same way (server allow-lists, blocked tools, the lethal-trifecta guard), because OWASP LLM06 "Excessive Agency" attacks land on tool calls, not prompts.
• Attributed audit, automatically — every decision becomes an event carrying user, agent, customer, destination, and trace linkage: the "automatic recording of events over the lifetime of the system" that EU AI Act Article 12 requires of high-risk systems.

Exactly one decision stays in the cloud — shared budget, which no single process can know — and the audit stream is asynchronously mirrored to the control plane as the system of record. Everything else is decided where the call originates.

Why the alternatives fail the compliance test

Dashboards observe. When an assessor working from NIST SP 800-171 (the CMMC baseline) asks how CUI flow is enforced, a graph of violations that already happened is an admission, not an answer.

Proxies enforce, but from the wrong side of the boundary. The sensitive prompt has already left the agent's process — often TLS-terminated by another service that now holds your most sensitive text. Proxies also miss what they cannot see: local tool execution, MCP calls over stdio, and any SDK that bypasses the configured gateway. Air-gapped and classified environments compound this: an enforcement point that requires routing traffic through an external service is a non-starter in networks built around NIST AI RMF-style risk postures precisely because it adds a dependency and a data sink. In-process enforcement ships with the workload — it works identically in a VPC, on-prem, or disconnected. (Full comparison: Why SDK-Based AI Security Beats AI Proxies.)

Failure posture is part of the architecture

Any control that depends on a remote service must answer: what happens when that service is down? In-process governance makes the answer an explicit, auditable choice — fail_open (availability first), fail_closed (block until policy is reachable), or fail_cached (replay the last known decision) — rather than an emergent property of a proxy outage. Policy updates propagate by bundle refresh: change a rule centrally and every agent process enforces it within one TTL, including the kill switch for a misbehaving agent.

Static guardrails and why they aren't enough: Runtime Security for AI Agents. The session-level attack this architecture uniquely catches: Detecting the Lethal Trifecta.