# Building Tower Trace: stopping agent tool calls and proving it in SigNoz

2026-07-26 · Source: AI on Medium · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Intermediate, medium

Summary

Tower Trace is a system designed to prevent AI agents from executing expensive or malicious tool calls by intercepting and controlling every agent tool invocation. Developed for the SigNoz hackathon, it addresses the inadequacy of prompt-only safety for agents with capabilities like reading tickets, drafting emails, hitting URLs, running DB queries, and exporting customer CSVs. The system's kernel enforces policies, checks budgets (e.g., \$0.10 per job for tenant "globex"), and manages approvals before allowing tools to run. Decision trails are sent to SigNoz, which is self-hosted with Foundry, accessible via "localhost:8080" for UI, "4317" for OTLP gRPC, and "8000" for MCP. Tower Trace demonstrates its effectiveness through three scenarios: a "happy" path with [ALLOW] lines, an "injection" scenario where a malicious ticket "TKT-666" triggers a "deny-export-untrusted" rule, and a "runaway" scenario where an agent is "killed_budget" after exceeding its cost limit. SigNoz provides dashboards, alerts (e.g., "tower-critical-deny", "tower-budget-kill"), and saved views for operational visibility.

Key takeaway

For AI Engineers building agentic systems, relying solely on LLM prompts for safety is insufficient when tools are involved. You must implement an explicit control plane, like Tower Trace's kernel, to intercept and enforce policies on every tool call. This approach ensures that malicious or expensive actions are genuinely stopped, not just refused in chat. Integrate robust observability, such as SigNoz, to verify policy enforcement and provide forensic data for denied or killed jobs, enabling transparent and auditable agent operations.

Key insights

Agent tool calls require explicit control plane enforcement, not just prompt-based safety, with observability for verification.

Principles

• Intercept all agent tool calls for control.
• Policy and budget modules must be pure.
• Observability is critical for agent control.

Method

An agent's tool request goes through policy evaluation, budget check, and potential approval before execution, with all decisions recorded.

In practice

• Implement a kernel to be the sole tool caller.
• Use AST tests to prevent direct tool imports.
• Lock span names in a contract file for consistency.

Topics

• AI Agents
• Tool Control
• Observability
• SigNoz
• Policy Enforcement
• Budget Management

Code references

• pranavk429/Tower-Trace

Best for: AI Engineer, MLOps Engineer, AI Security Engineer

Related on AIssential

• Engineering an Autonomous AI Study Agent: Tracing the Agentic State Machine — Robust AI agents require deep, full-stack observability via OpenTelemetry and unified platforms like SigNoz to ensure reliability and control.
• Tracing an AI Agent's Reasoning: Building Observability Into Your Pipeline — AI agents need specialized observability to trace non-deterministic decisions and prevent silent failures in production.
• openclaw doesn’t need more autonomy. it needs proof. — When agents interact with systems, verify outcomes with a run ledger, not just chat responses.
• If You Can’t Observe Your Agents, You Don’t Own Them: A Deep Dive into Multi-Agent Observability… — Agent observability, enabled by OpenTelemetry and SigNoz, is crucial for debugging, cost management, and reliability of production AI agents.
• I Let an AI Investigate Production. Then SigNoz Made It Explain Itself. — AI-driven incident response requires strict separation of investigation from mutation, enforced by policy and verification.
• Building a Production-Ready Agentic Fraud Detection System — Part 1: The Full Picture — Production fraud detection requires agentic orchestration, human-in-the-loop processes, and robust observability beyond model metrics.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by AI on Medium.