Developers · Agent onboarding

Bring your agent to IntSen.

Your agent keeps running where it runs today, on the framework you already use. Point its model calls at the gateway, describe it in two YAML files, and switch on the checks you want.

Before you start

You need three things

Application service

Your team's space in IntSen. Set up once by the platform team.

An OAuth client

Client id and secret for your agent, from your IntSen administrator or your team's registered identity provider.

intsenctl

Install with pip install intsen, or apply through your team's config repository pipeline.

Step 01

Describe your use case

The Registration says which models your use case may use, how sensitive its data is, and what it may store. Everything not written here comes from platform defaults.

registration.yaml

# registration.yaml — your use caseapiVersion: gateway.ai.intsen.com/v1kind: Registrationmetadata:  name: field-service-assistant-prod  namespace: field-service                 # your application servicespec:  description: Assistant for field technicians (manuals, parts, work orders)  owners:    - { email: product-owner@example.com }    - { email: tech-lead@example.com }  maxDataClass: confidential               # public | internal | confidential | restricted  clients:    - { clientId: fleet-advisor-prod }     # the OAuth client your agent signs in with  models:    - provider: openai      ids: [ gpt-5.4-mini ]  capture: { bodies: true, retentionDays: 90, redactPii: true }

Step 02

Describe your agent

The Agent names its owners and purpose and links it to the use case. Set a cost and time limit per turn: it stops an agent stuck in a tool-calling loop.

agent.yaml

# agent.yaml — your agentapiVersion: governance.ai.intsen.com/v1kind: Agentmetadata:  name: fleet-service-advisor  namespace: field-servicespec:  displayName: Fleet Service Advisor  description: Diagnoses equipment issues and drafts work orders for technicians.  owners: [ { email: field-ai-owners@example.com } ]  registration: field-service-assistant-prod   # the use case above  clientIds: [ fleet-advisor-prod ]            # same OAuth client  governance: { dataClass: confidential }  tasks:    limits: { maxCostUsdPerTask: 0.50, maxDurationSeconds: 900 }

Apply both files

intsenctl apply -f registration.yaml -f agent.yaml --dry-run   # validate and show the diffintsenctl apply -f registration.yaml -f agent.yaml

Step 03

Point your agent at the gateway

Change the base URL, use your agent's OAuth token and add the headers. That is the whole integration—you don't tell IntSen when a turn ends.

x-intsen-registration-id — once
x-intsen-agent-id — once, optional
x-intsen-task-id — a new id for every user message
x-intsen-conversation-id — per conversation, recommended
x-intsen-user-id — per conversation, optional; stored as a hash

Step 04

Flip the switches

Everything here is optional. Without it you still get tracing, cost and the platform default guardrails. Settings can only make things stricter than the defaults.

On by default

Harmful text (hate, violence, self-harm, sexual): Recorded
Harmful images: Blocked at medium severity
Harmful image or video generation prompts: Blocked
Prompt injection (user input and tool results): Recorded
Personal data (cards, IDs, bank accounts, emails, phone numbers): Recorded
Secrets (keys, tokens, passwords): Recorded
Built-in agent rules: imminent danger, sexually explicit, sensitive personal data: Block the user's message at high confidence; replies recorded
If a check fails or times out: The call continues; the failure is recorded

Switch catalog
You want	Setting	File
Block prompt injection	guardrails.promptInjection.action: block	Registration
Mask personal data before the model	guardrails.pii.action: mask	Registration
Block secrets in user input	guardrails.secrets.action: block	Registration
Check answers while they stream	guardrails.checkStreamedOutput: during	Registration
Monthly budget for the use case	budgets: { monthlyUsd, onExceed: deny }	Registration
Approval before the use case goes live	requireApproval: true	Registration
More built-in agent rules	guardrails.builtIn.systemPromptLeak …	Agent
Catch role-play and jailbreak attempts	guardrails.builtIn.jailbreakAttempt	Agent
Your own rule in plain English	guardrails.customRules	Agent
Your own policy service	guardrails.webhooks	Agent
Personal data building up across a turn	guardrails.taskChecks.piiAccumulation	Agent
Limits per turn	tasks.limits	Agent
Monthly budget for the agent	budget: { monthlyUsd, onExceed }	Agent
Compliance assessment on every turn	compliance: { enabled: true, model }	Agent
Live quality scores, golden tests from CI	an Evaluation file	Evaluation

registration.yaml — more switches

# registration.yaml — more switches (excerpt)spec:  requireApproval: true  budgets: { monthlyUsd: 4000, perRequestMaxUsd: 2.0, onExceed: deny }  guardrails:    promptInjection: { enabled: true, action: block, checkToolResults: true }    pii:             { enabled: true, action: mask }    secrets:         { enabled: true, action: block }    checkStreamedOutput: during

agent.yaml — more switches

# agent.yaml — more switches (excerpt)spec:  budget: { monthlyUsd: 1500, onExceed: alert }  guardrails:    builtIn:      systemPromptLeak: { enabled: true, action: block }      outOfScope:       { enabled: true, action: record }    customRules:      - name: no-customer-contacts        rule: "Never disclose customer contact details."        enforcement: block        appliesTo: [ user, reply, toolCall ]    taskChecks:      piiAccumulation:   { enabled: true }      repeatedJailbreak: { enabled: true, terminateTask: true }  compliance:    enabled: true    model: gpt-4.1-mini    alerts:      critical: { enabled: true, recipients: [ field-ai-owners@example.com ] }

Step 05

Add quality evaluations

A third file turns on quality scoring. Live evaluations grade a sample of real turns; golden tests run scripted conversations from your CI and fail the build when quality drops.

evaluation.yaml

# evaluation.yaml — optional quality evalsapiVersion: governance.ai.intsen.com/v1kind: Evaluationmetadata: { name: fleet-service-advisor-eval, namespace: field-service }spec:  agentRef: { name: fleet-service-advisor }  live:    enabled: true    metrics:      - { name: goal_completion, sampleRate: 0.2, passThreshold: 80 }      - { name: context_adherence, sampleRate: 0.2, passThreshold: 80 }  golden:    enabled: true    defaultJudgeModel: gpt-4.1-mini    gates: { minPassRate: 0.9 }    datasets:      - name: smoke        scenarios:          - id: seal-in-stock            steps:              - input: "FX-2231 shows pressure warnings. Is the pump seal in stock in Dallas?"                assertions:                  - { kind: tool_call, tool: check_inventory, minCount: 1 }                  - { kind: text_contains, values: [ "in stock" ] }                  - { kind: llm_check, criteria: "Names the likely fault and the part number" }

Run golden tests in your pipeline

intsen eval run --agent field-service/fleet-service-advisor --dataset smoke \  --version $COMMIT --adapter "python tests/run_case.py" --junit out/evals.xml

Step 06

See it in the Console

Each agent gets its own pages with everything IntSen recorded about it.

Overview: Turns per day, users, errors, latency, tools used, cost
Traces: Conversations → turns → each model call, tool call and tool result; cost and checks per turn
Quality: Live scores, golden runs and their trends, failing scenarios
Guardrails: Your settings and where each comes from, blocks and flags, failures
Compliance: Sensitive data, toxicity, safety, prompt attacks, off-purpose requests; review queue; alerts
FinOps: Cost of the agent's calls, sub-agents, guardrails and evals, per user and per turn; budget use

Onboard your first agent with us

In a pilot we connect one of your agents together and review what IntSen records with your team.

Book a live demo Discuss an enterprise pilot