Govern the effect, not the prompt.
Novyx Control evaluates what an agent is actually trying to change in production, predicts the blast radius from live facts, routes approval, and only then lets the action execute.
A worked example
The flagship wedge is the blast-radius gate for schema migrations. Instead of a content regex or a blanket approve/deny, it reads each statement an agent proposes and grades it on reversibility × live data impact.
Five additive statements pass untouched. The irreversible ones are graded on the rows they would actually destroy — and the unrecognized one fails closed.
An agent proposes an 8-statement migration. Five are additive. Three are not.
CREATE TABLE feature_flags (id bigint, name text)additive / reversible
ALTER TABLE users ADD COLUMN last_seen_at timestamptzadditive / reversible
ALTER TABLE users ADD COLUMN referral_code textadditive / reversible
CREATE INDEX idx_users_last_seen ON users (last_seen_at)additive / reversible
ALTER TABLE orders ADD COLUMN coupon_id bigintadditive / reversible
ALTER TABLE users DROP COLUMN legacy_password_hashusers.legacy_password_hash · 2,300,000 rows · irreversible; 2,300,000 rows destroyed
ALTER TABLE events ALTER COLUMN payload TYPE varchar(255)unrecognized statement — fail-closed to human review
DROP TABLE audit_events_2019audit_events_2019 · 84,000,000 rows · irreversible; 84,000,000 rows destroyed — catastrophic
Statement 6 of 8 drops column users.legacy_password_hash, which holds 2,300,000 rows — irreversible. Statement 7 is an unrecognized narrowing ALTER COLUMN — fail-closed to human review. Statement 8 drops table audit_events_2019, which holds 84,000,000 rows — catastrophic. The other 5 are additive.
Gated 3 of 8 statements; the rest auto-allowed.
The control lifecycle
Request
Agent submits the intended effect instead of receiving raw credentials.
Classify
Novyx parses the exact action and joins it with live facts — reversibility and rows affected.
Decide
Governance returns allow, require approval, or block — and fails closed on the unknown.
Execute
The connector performs the action only after the decision clears.
Prove
Every decision and result is written to a tamper-evident audit trail.
One model, many effects
Migrations are where the gate is proven today. The same model — classify the effect, predict impact, gate execution, record evidence — extends to every production-changing action an agent can take.
Policies become the mechanics, not the message.
Teams can still encode rules, thresholds, reviewers, and connector permissions. The operator-facing product is simpler: what will this agent change, what can go wrong, who approved it, and how do we recover?