Agent Guard Runtime vs Edge

Decision

Use this guide when choosing agent guard runtime vs edge. Neither option is universally superior; choose per workload and keep an escape path.

Choose Agent Guard Runtime

Runtime Guard sees normalized tool context immediately before in-process execution.

Choose Edge

Edge Guard protects an API boundary across heterogeneous callers before traffic reaches the service.

Material tradeoffs

• Runtime enforcement must be present in every execution host.
• Edge enforcement needs signed identity propagation and cannot infer hidden application state.

Validate the choice

• Test both paths on the same representative set.
• Compare quality, latency, cost, security, and operability.
• Document the decision, evidence window, review date, and rollback.