Where the gate runs
The runtime is one piece of software, but it can occupy three positions in an architecture, and choosing is less about preference than about who builds the agent and where the consequences land.
Whichever position you choose, the decision is the same code path. The same policy file produces the same verdict in-process, in a firewall, or across the network, and every position writes the same audit event.
Position
Embedded
Beside
As a service
Embedded: for the people building the agent
If you own the agent's code, the shortest path is
the SDK. governTools wraps the tools an agent may call,
which makes we forgot to check impossible rather than unlikely, and
guardVerified adds postconditions and rollback for the actions that change
the world.
This is also the position for a company that ships AI into other companies. The product keeps its own interface, its own tools and its own name; Memnox supplies the customer organization's authority underneath it. The customer never has to leave the product to be governed by their own rules. See running Memnox for your customers.
Beside: for the agent you did not build
An agent you cannot modify can still be governed at the seam it uses to reach
its tools. The MCP firewall wraps a tool server, and every
tools/call passes through the runtime on the way in. A denied tool is not
listed at all, so the agent is never tempted by a capability it was never
going to be allowed to use.
This position is the only one where redact means anything, because only a
process holding the payload can rewrite it.
As a service: for the fleet
A single laptop runs the gate with no infrastructure. A team runs
memnox serve so twelve agents, five editors and a CI
pipeline all ask the same runtime, share one policy version and one audit
chain, and a rule changed once is changed everywhere.
The scaling story is deliberately boring: Postgres for shared state, Redis for shared rate limits, flags documented on the runtime page.
They compose
Most real deployments are a mixture, and that is the intent. The engineer's editor is governed by hooks, the vendor's support agent asks over the network with an ask grant, the internal automation embeds the SDK, and the tool server nobody trusts sits behind the firewall. Four positions, one policy, one record.