Galileo Protect deprecated: what to use instead

What Galileo Deprecated

Protect was Galileo's runtime guardrail. It ran checks on the inputs or outputs of LLM workflows to block harmful requests, prevent data leaks and reduce hallucination risk. Its configuration was hierarchical: a rule tested one metric against a condition, a ruleset combined rules with AND logic and carried an action, and a stage held prioritised rulesets and returned the highest-priority one that fired. There were two actions: passthrough, which left handling to your application, and override, which returned one of a set of fixed responses.

The Protect page now opens with the notice: "Protect is deprecated as of June 2026. We don't recommend setting it up as a new solution," followed by "set up Agent Control instead." It gives no step-by-step migration or shutdown date for existing deployments. One constraint carries over to whatever you choose: the same docs say runtime protection "either requires Luna-2 on the enterprise tier of Galileo, or custom code-based metrics", because a check on the hot path has to be fast.

What Agent Control Is

Agent Control launched in March 2026 as an open-source control plane for AI agents. Galileo's docs describe it as a layer for evaluating "LLM and tool inputs and outputs during agent workflow execution". A control returns one of five decisions: deny raises a ControlViolationError and stops execution, steer redirects the agent, warn notifies without blocking, log records the event, and allow lets it through. Checks attach to decorated functions in your agent, so they run at each step rather than only at a gateway's entry and exit.

• License and SDKs. Apache-2.0, with Python and TypeScript SDKs; the Python package is agent-control-sdk.
• Evaluators. Built-in regex, list, JSON and SQL evaluators, or your own. Model-based plug-ins include Galileo's Luna, NVIDIA NeMo, AWS Bedrock and Cisco AI Defense.
• Integrations. LangChain, CrewAI, Google ADK and AWS Strands; launch partners included Glean, ServiceNow and Rubrik.
• Operations. A client-server design: the SDK calls an Agent Control server backed by PostgreSQL, and controls change through its API or UI without redeploying the agent.

Two versions exist. The open-source one is yours to deploy and run. A centrally managed Agent Control, added to Galileo's release notes on 5 June 2026, is available to enterprise customers only.

# Agent Control server
curl -L https://raw.githubusercontent.com/agentcontrol/agent-control/refs/heads/main/docker-compose.yml | docker compose -f - up -d

# Python SDK
uv venv
source .venv/bin/activate
uv pip install agent-control-sdk

Four Ways to Replace Protect

Agent Control, Open Source

The default path, and the one Galileo recommends. A Protect rule - a metric, a condition, an action - maps naturally onto a control with an evaluator and a decision, and Agent Control adds tool inputs and outputs and a steer decision that is gentler than an override. The cost is operational: a server and a PostgreSQL database are now yours to run. If your Protect rules used Luna-2 metrics, check that the Luna evaluator is available to you; code-based evaluators such as regex and JSON checks need nothing extra.

Galileo Enterprise

If you are already on Enterprise, this is the least work: the pricing page lists real-time guardrails on that tier, and the managed Agent Control is Enterprise-only. Ask your account team whether existing Protect configurations carry over, because Galileo has not published a migration.

Future AGI Protect

If what you guarded with Protect was a chatbot's model input and output, Future AGI Protect is the nearest like-for-like: real-time block, warn, mask or log on text, image and audio, inline in its gateway or through an SDK. Its tool-call checks cover traffic routed through that gateway. Future AGI publishes an Apache-2.0 core and separately licensed enterprise code, with a managed cloud if you would rather not run it.

Failproof AI Policies

Failproof AI is not a like-for-like model-I/O replacement for Protect. It traces and evaluates agent sessions, automatically groups recurring behavioral failures into findings and recommends what to fix. When a finding identifies a recognizable high-risk action in a supported harness, the team can draft a policy from the issue, backtest it against historical calls and deploy it in observe mode before steering or blocking the action. Supported hooks cover coding CLIs such as Claude Code, Codex, Cursor and Goose, plus the Hermes and OpenClaw chat gateways. A support chatbot that needs its generated text filtered before delivery still needs a check in the application or gateway.

Moving One Guardrail Across

Take a common Protect setup: a ruleset on the input stage that fires when a prompt-injection metric crosses a threshold, with an override action that returns a canned refusal. Moving it to Agent Control takes four steps.

1. Write down what the ruleset did

   The metric, the threshold, the stage and the action. Note which metrics ran on Luna-2, because that decides which evaluator you can use next.

2. Pick the evaluator

   The Luna evaluator if you have Luna-2 on Enterprise. Otherwise a built-in regex or list evaluator for known patterns, or a model-based plug-in such as NVIDIA NeMo, AWS Bedrock or Cisco AI Defense.

3. Map the action

   Override becomes deny: your application catches ControlViolationError and returns the canned response itself. Passthrough maps to warn or log. Where you used override only to nudge the model back on track, consider steer.

4. Run it in log first

   Deploy the control with a log decision for a week, compare what it would have blocked with what Protect blocked, and switch it to deny once the two agree.

If the guardrail you are moving is about an agent's actions rather than its text - never push to a release branch, never touch production config - it may belong at the tool hook instead. In a coding agent, that is a Failproof AI policy:

// release-policies.js - an action rule, checked before the command runs
import { customPolicies, allow, deny } from "failproofai";

customPolicies.add({
  name: "block-push-release",
  description: "Deny git pushes to release branches from coding agents",
  match: { events: ["PreToolUse"] },
  fn: async ({ toolName, toolInput }) => {
    if (toolName !== "Bash") return allow();
    const command = String(toolInput?.command ?? "");
    if (/\bgit\s+push\b/.test(command) && /\brelease\//.test(command)) {
      return deny("Release branches are pushed by CI. Open a PR against the release branch instead.");
    }
    return allow();
  },
});

Install it with failproofai policies --install --custom ./release-policies.js, and check it is listed with failproofai policies.

How to Choose a Replacement

Stay with Galileo when you already use Enterprise and want the managed Agent Control path. Run open-source Agent Control when you want the closest migration and can operate its server and PostgreSQL database. Choose Future AGI when the main requirement is filtering multimodal model traffic through a gateway. Consider Failproof AI when the broader job is to find recurring failures across agent sessions, connect them to trace evidence and a recommended fix, and add a tested behavioral policy when the failure is a preventable tool action.