What is the current name for Zapier's agentic step?

AI by Zapier is the current product term for agentic reasoning and tool calling inside the Zap editor. Zapier Agents still names the standalone product and existing deployments. The label also remains in the migration path and some audit-event categories. Inventory both labels during the transition. Tie each security test to the exact deployed asset.

Are AI Guardrails by Zapier detections deterministic?

Zapier describes its LLM-based detections as likelihood assessments, and its documentation warns that checks may miss relevant content or produce false positives. It also says AI Guardrails supplements existing measures. A production control should record the detector and configuration. Preserve the result and subsequent workflow branch, along with the reviewer and test set, rather than promising a guaranteed classification.

Does Zapier's Audit Log contain every prompt and response?

The public Audit Log guide documents an activity summary and affected object, plus the performer and timestamp. It also lists a range of account or asset event categories. Treat it as evidence for those fields. Confirm prompt and response availability in the specific Zap history or product surface used by the workflow. Use separate request-boundary evidence for inference authorization decisions.

Can DeepInspect govern every Zapier action?

DeepInspect applies to authenticated LLM inference traffic explicitly routed through its HTTP proxy. Zapier publication and MCP tool scope remain under Zapier controls. Managed connections and app credentials stay there too, while Gmail or Salesforce actions and workspace permissions remain under Zapier and application controls. A BYOM or own-provider setup still needs an integration test. That test must prove the configured model endpoint can route through the gateway with usable identity context.

Zapier AI Security: Separate Workflow Controls from Model Routes

A Zap workflow can accept an event and pass content into AI by Zapier. Then it can call a tool before updating a business application. Each hop carries a different credential and policy owner, so Zapier AI security starts by separating workflow publication from model selection. Tool availability and app authorization form another boundary. Inference routing determines where an independent gateway can operate. I want to follow those handoffs in order. The limit is narrow: only a model-bound HTTP request placed on a supported external route can cross an independent AI gateway.

TL;DR

AI by Zapier places agentic reasoning and tool calling inside the Zap editor. Administrative controls cover publishing and model access, along with agentic behavior.
AI Guardrails by Zapier screens selected workflow content. Zapier documents missed detections as well as false positives for LLM-based checks.
Zapier MCP scopes available tools. App actions and credentials remain governed by Zapier and each connected application.
DeepInspect covers only authenticated LLM HTTP traffic explicitly routed through its proxy. Coverage depends on endpoint compatibility and supplied identity context.

AI by Zapier brings agentic work into the editor

Zapier is moving standalone Agents functionality into AI by Zapier. Its migration guide for Agents and AI by Zapier says tool calling and AI reasoning now run within an AI by Zapier step, where they support autonomous task execution. Migrated runs appear in Zap history with tool and data details, model-tier information, and task-consumption details.

The guide also documents administrative controls. Administrators can require approval before publishing Zaps containing AI steps, or they can disable tool calling and agentic behavior at account level. Model restrictions are separate. The term Zapier Agents remains valid for the standalone product and existing deployments, and it also appears in legacy audit events and the active migration path. Current architecture documents should label each deployed object precisely instead of declaring the naming transition complete.

Run one publication test with a controlled AI step and capture the approval result. Next, disable agentic behavior in a test workspace and repeat the run. Compare the records. They show which account-level control actually changed execution.

AI Guardrails adds probabilistic screening

AI Guardrails by Zapier documentation lists checks for PII and sentiment, plus toxicity. Separate checks cover prompt attacks and jailbreak attempts. Zapier says some actions use AWS Comprehend and others use Amazon Bedrock, while its documentation describes LLM-based detections as likelihood assessments rather than deterministic rules. The product supplements existing security and privacy measures, including compliance controls.

The limitation belongs in the control statement: Zapier explicitly warns about missed detections and false positives. Processed content can also appear temporarily in Zapier logs and Zap runs. That includes PII submitted for detection. Retention review therefore belongs beside detector testing.

I would block any control register that marks an AI Guardrails step as guaranteed prevention because that claim exceeds Zapier's own documentation. Use a labeled evaluation set. Record the selected detection action and threshold, then preserve both allowed and flagged results with the Zap version that produced them.

MCP tools and app actions need their own authority

Zapier MCP documentation describes a connection between AI clients and Zapier-managed app tools. Zapier handles app connections and credentials, as well as rate limits. Administrators can expose dynamically selected tools or a fixed tool set. Tool scope therefore begins at MCP configuration and continues into each connected application's permissions.

A model's decision to request a Gmail draft or Slack message is separate from the inference call. The same separation applies to a Salesforce update or Jira change. Zapier and the target application govern the resulting action, so human approval and transaction limits should sit at that business-action boundary. Recipient restrictions and rollback belong there too.

Test a fixed MCP tool set with one allowed synthetic action and one out-of-scope action. Keep the MCP configuration and tool request, but preserve the app connection identity and application response as separate evidence. On screen, the evidence should show a short tool list beside a rejected action. That picture is more useful than a broad diagram labeled agent controls.

The zero-trust AI architecture article provides the larger separation between authenticated identity and request-specific authority.

Account evidence has a defined scope

Zapier's account Audit Log guide lists an activity summary and affected object. It also records the performer and timestamp. Documented event categories cover account changes and Agents, along with connections and knowledge sources. Other categories include MCP server and tool changes, plus other Zapier assets. This is useful account and asset activity evidence.

Prompt content and response content require separate confirmation. So do detector policy versions and per-inference authorization decisions. Never expand the published Audit Log fields by assumption. Link each review claim to a field visible in the tenant. Otherwise, mark the evidence as coming from Zap history or AI Guardrails output, the connected application, or an external gateway.

The post-authentication gap gives a useful evidence model. It begins with originating identity and request context, followed by policy version, outcome, timestamp, and integrity protection. A Zapier review can map each field to its actual source. Blank cells expose the remaining evidence gap without devaluing the account log.

Own-provider configuration creates a route to investigate

Zapier documents a configuration for organizations that require their own model provider. The AI by Zapier provider restriction guide starts by disabling Zapier's built-in models. Administrators then restrict app access to the approved service and mark it as a managed app, placing credential creation and sharing under administrative control.

That configuration supplies an architectural lead, but it provides no proof that the provider endpoint accepts an external gateway URL or preserves the originating identity. Confirm endpoint configurability and authentication first. Then test payload compatibility, streaming behavior, and timeout handling. Record the exact identity fields available to the request. Before crediting coverage, capture one routed HTTP call in a test environment.

Built-in model calls and hosted Zapier paths remain outside an external gateway when they bypass its endpoint. Zapier calls to Gmail or Slack also sit outside the LLM boundary, as do calls to Salesforce, Jira, and other application APIs. The HTTP AI policy enforcement model applies only to the explicitly routed inference request.

A five-part review keeps ownership clear

Build the production review around five executed checks rather than one AI control row.

Publishing: require the intended approval for a Zap containing an AI by Zapier step. Preserve the approver and asset version.
Screening: run labeled content through AI Guardrails by Zapier. Record the detector configuration and likelihood result, then preserve the workflow outcome and retention setting.
Tools: constrain Zapier MCP to an approved tool set. Exercise an allowed action before sending an out-of-scope request.
Applications: verify the managed connection identity. Confirm the authorization result inside each receiving application.
Inference route: capture the destination endpoint and supplied caller identity. Preserve the policy version and allow or deny result for a supported model call routed through an external HTTP gateway.

This division assigns Zapier administration and application security to the controls they can actually operate, while IAM and AI platform engineering receive their own controls. It also prevents an inference proxy from receiving credit for an application action it never sees.

DeepInspect

This is the gap DeepInspect closes for a supported, customer-controlled inference route. DeepInspect sits inline as a stateless proxy between an authenticated user or agent and an LLM endpoint. The integration must explicitly route the HTTP request through DeepInspect and supply identity context. DeepInspect then evaluates the role and prompt classification before checking the destination, requested operation, and versioned policy. Only then does it forward the request.

Zapier retains control of Zap publication and AI by Zapier settings. Its administrative boundary also covers Workspaces and Managed Connections. App Access Controls and Action Restrictions remain there, along with Zapier MCP tools and calls to business applications. DeepInspect adds an independent allow, deny, or redact decision, and each routed LLM request receives a signed, tamper-evident record. Traffic that bypasses the proxy stays outside visibility. Book a technical deep dive at deepinspect.ai.