See the path you instrumented.
Connect the agent root, model call, and tools that ran.
Runtime control for production AI agents
Stop tool calls that break your rules.
Trace supported agent runs, test policies in audit mode, and block supported tool proposals with configured Guard policies.
Start free. No card required. Audit before you enforce.
WHY STASO
The final answer can hide the risky part.
An agent can choose the wrong tool, then return a convincing reply. Staso exposes the run and the policy decision.
Test the rule without interruption.
Audit records would-block while the action stays allowed.
Block reviewed matches.
Enforce stops matching supported proposals before dispatch.
Rules become active when attached to an enabled, scoped policy.
SUPPORTED PATHS
Start with the agent path you already run.
Choose one integration. Continue to its setup after sign-in.
OpenAI Chat Completions
Trace Chat Completions. Audit or block configured tool proposals.
agent.py
$ pip install "staso[openai]"
import staso as st
from openai import OpenAI
st.init(agent_name="support")
client = OpenAI()
@st.agent
def support_agent(question: str):
return client.chat.completions.create(
model="gpt-5",
messages=[{"role": "user", "content": question}],
tools=[{"type": "function", "function": {
"name": "delete_customer",
"parameters": {"type": "object"},
}}],
)Use @st.agent for the run and @st.tool for measured functions.Start with OpenAI
Loading pricing…
FAQ
What to know before you start.
01Can Staso block every tool call?
No. Supported integrations check supported model proposals. Direct Python calls need st.guard(). @st.tool observes execution only.
02What is the difference between audit and enforce?
Audit records would-block and allows the action. Enforce blocks a matching supported proposal before dispatch. An enabled policy must contain the rule.
03What happens when Guard cannot return a decision?
Guard defaults to fail-open. Fail-closed is optional. The result reports the effective action and failure category.
04How can I limit captured data?
Suppress request content, system prompts, tool schemas, tool arguments, and output independently. Sanitization covers recognized protected values, not complete PII or secret detection.
START WITH ONE RUN
Trace one real run. Test one rule.
Choose an integration and open your first queryable trace. No card required.