What Warden is and the problem it solves: a brake and a black-box recorder for agent actions.

The token-as-interface model — who an agent acts for, and how it stays provable.

How the proxy, policy engine, approval queue, and audit chain fit together.

What Warden defends, what it doesn't, and where the trust boundaries sit.

The one coupling point — a signed token — and how any platform maps to it.

On-behalf-of-user + Unity Catalog grants at the action boundary.

Bedrock AgentCore — STS AssumeRole + session tags as native ABAC.

Vertex ADK / A2A — workload identity and per-hop delegation.

Route a ReAct agent's tool calls through the proxy with one line.