Choose one call you own
Start with a safe read already used by your agent. The integration flow is agent → tool or API client → AGINDOW guard boundary → vendor API. Your application owns credentials, retries, operation labels and the original client; AGINDOW inspects the configured boundary and reports findings. Keep framework-specific behavior in the original client.
Verify detection before integration
Run the complete configured Quickstart for your language. Replace its demo.detect operation and tool together with the name of your actual read. Choose request or response fields and independently collected comparable windows for that operation. Do not copy the synthetic 1 → 100 data into an application and describe it as live evidence.
Wrap the callable
Node: create the configured instance, await sdk.ready, then pass the callable to sdk.guard with tool and operation: read. Python: construct Agindow with selection, check ready, then use sdk.guard as a decorator or wrap the callable directly. Preserve the receiver when calling existing client methods; a small closure around the existing method is often easiest to review. The SDK does not supply vendor credentials or automatically change your transport.
Check behavior and evidence separately
Verify the original return value and upstream exceptions remain intact in observe mode. Inspect drift and bypass events separately. An unchanged result is expected in observe; it does not prove there was no drift. Exercise the application’s own timeout and cancellation paths before expanding the boundary. Streaming and framework batch coverage require separate evaluation.