1. Declare
Pick an agent and set its limit: which tools, MCP servers and hosts it may use, which data classes it may touch, its autonomy ceiling and its schedule.
Govern · Agent Governance
Turn your AI policy
into limits agents follow.
Declare what each agent may use and how far it may go: tools, MCP servers, hosts, data classes, autonomy and schedule. Lustena evaluates every session against the limit and tells you in plain language when it is crossed.
Works with
ChatGPTClaudeGeminiCopilotClaude CodeCursorCrewAILangGraphPolicy documents don't stop an agent
Lustena turns policy into limits.
Without a control plane On the control plane
Definition
Without a control plane: The AI policy is a PDF nobody can check an agent against. Each team interprets it differently, if at all.
On the control plane: A limit per agent in six dimensions, versioned, with who changed what and when, readable by people and by the platform.
Evaluation
Without a control plane: Nobody knows which agent exceeded its mandate until something breaks or a customer complains.
On the control plane: Every session is evaluated against the agent's limit. Crossing it raises an alert with the dimension, the observed value and the allowed one.
Enforcement
Without a control plane: Blocking is all or nothing: ban the tool, or allow everything.
On the control plane: By default, agents running outside Lustena are flagged, not blocked. On the Enterprise plan, warn, block or redact per data class and per team. Agents built on the Lustena runtime are stopped before the call is made.
Definition
A limit per agent, versioned, with who changed what and when
ProductionGPT · Proposals · owner ana@acme.com
Limit history
Every change is a new version, attributed and dated. Previous versions stay readable.
Versions · 3
- v3data classes: none personalana@acme.com · Oct 12current
- v2hosts: + api.hubspot.comrafa@acme.com · Sep 22replaced
- v1created · tools, MCP servers, hostsrafa@acme.com · Sep 3replaced
Alerts · limit v3 · 24h
data class: personal · observed 3 × card number · allowed: none
paste · chatgpt.com · Oct 14 · 02:41 · webhook → #sec-alerts
From policy to limits in an afternoon
Start from what the inventory already shows, declare limits where it matters, and let the alerts tell you where reality differs from policy.
2. Version
Every change creates a new version of the limit. Previous versions stay visible, and you can compare the last 24 hours of sessions with the current one.
3. Evaluate
Findings from the browser, events from the SDK and results from scans are evaluated against the limit on every session.
4. Alert
A crossed limit produces one alert in plain language: which dimension, what was observed, what was allowed. It reaches Slack, a ticket or your SIEM through webhooks.
Dimensions
- Tools
- MCP servers
- Hosts
- Data classes
- Autonomy level
- Schedule
Lifecycle
- Versioned limits
- Change history
- Last 24 hours view
- Per-agent status
Decisions
- Flag by default
- Warn, block or redact (Enterprise plan)
- Stop on the Lustena runtime
- Webhooks
Sources
- Browser findings
- SDK events
- Scan results
- MCP server activity
Guardrails that don't depend on training.
Most people using AI at work were never trained for it. The people who understand the risk set a limit once, and it applies to everyone else.
Outside the loop · where legacy controls sit
- AI policy PDF
- Training sessions
- Acceptable use form
- Annual review
No line of sight inside
Inside the loop · where Lustena sits
Agent
every action →Lustena← result · next step
System
The limit is evaluated here, on every session, for every agent.
Questions
Who can change a limit?
Workspace admins, through the platform or the MCP server. Every change is versioned and attributed.
What happens when a limit is crossed?
The session is flagged, an alert is created with one sentence naming the dimension, the observed value and the allowed one, and webhooks fire. By default nothing is blocked; on the Enterprise plan the limit can warn, block or redact.
Can limits apply to ChatGPT use?
Yes. Findings from the browser extension carry the data classes detected, so a limit on data classes applies to employee agents as well as code agents.