Watsonx Orchestrate Plug‑ins for Security and Compliance

Watsonx Orchestrate now supports plug-ins that intercept agent inputs and outputs to enforce safety, security, and compliance requirements. Two plug-in types exist: pre-invoke (runs before the agent processes a request) and post-invoke (runs after the agent generates a response). Practical examples show how to mask or block offensive words in user input using AGENTPREINVOKE, and how to redact email addresses in agent output using AGENTPOSTINVOKE. Both plug-in types are implemented as Python tools with specific kind annotations, registered in the agent's YAML definition, and imported via the orchestrate CLI. Plug-ins also have access to user context such as email, tenant ID, and username.