Apply agent policy across models, tools, and production data

An agent can move from a model request to a tool call, a direct API request, and a production query. Formal applies policies to supported traffic across that workflow.

Keep upstream secrets out of the agent

Formal can inject configured database credentials, provider keys, API tokens, and remote MCP OAuth credentials at the proxy.

Limit what the agent can read and change

Policies can block destructive database operations, mask sensitive results, and restrict supported remote tool and API actions, using the agent identity and request context.

Trace actions back to an identity

Formal records supported queries, commands, tool calls, and model activity. Agent identities and human attribution help security teams investigate what happened.

Secure the full agent workflow

Tailscale connects agent workloads and offers PAM and Aperture for privileged and AI access. Formal applies one policy language to supported database requests, model traffic, remote MCP calls, and direct API activity.

The comparison covers how an agent receives identity, obtains temporary access, uses credentials, calls models and tools, and reaches production systems. It also distinguishes protocol-level controls from the gateway, network, or runtime integrations Tailscale provides.

Limit what the agent can retrieve and send

A coding agent might read a production table, call a remote tool, and send the result to a model provider. A useful policy needs to account for the data returned as well as the action requested.

Formal can allow a supported read operation, mask sensitive fields in the result, block a destructive statement, and apply separate policies to the next supported model or remote tool request. Each connection must pass through the relevant Formal proxy for those policies to apply.

Why teams move from Tailscale to Formal

  1. Scope access to the agent task. Give an agent identity-based, time-bound access and apply protocol policies to the requests it makes within that access.
  2. Reduce sensitive data in model context. Mask supported database results and model or tool content before protected information moves to the next service.
  3. Cover direct connections as well as tools. Agents also use database clients, HTTP SDKs, and subprocesses. Endpoint can inspect supported network traffic selected by routing rules outside a single MCP client.