On October 20, 2026, at the Rhapsody Connect Executive Track in Boston, the company announced the general availability of Guardian. This release marks a significant evolution from the company’s earlier API Guardian, introduced in October 2025, shifting the focus from static API management to dynamic, runtime agent governance.
Healthcare organizations face a persistent mismatch between the open-ended nature of AI models and the strict requirements of clinical environments. While generic identity providers like Okta handle user authentication, they often lack the granular, context-aware controls required for autonomous agents interacting with sensitive health data. Rhapsody frames Guardian as a healthcare-native gatekeeper that authenticates agents, enforces scoped access, and applies rate limits specifically tailored to clinical workflows.
A critical component of this architecture is the integration of the Model Context Protocol (MCP) as a first-class governed endpoint, alongside traditional FHIR and REST interfaces. By treating MCP as a managed surface, Rhapsody allows builders to standardize how agents access clinical data. According to the company, this helps health systems put CHAI and Joint Commission guidance into practice by providing access controls and audit trails for AI agents and APIs.
Enterprise architects should view Guardian as more than a simple access control tool. In highly regulated industries, the audit trail is increasingly becoming a product in its own right. By recording every agent, MCP, and API activity, Guardian provides the transparency necessary for clinical oversight and regulatory reporting. This capability is essential as organizations move toward more complex, multi-agent systems where tracing the provenance of a decision is as important as the decision itself.
The industry is seeing a shift toward the verticalization of governance. As noted by the TGVP infrastructure report, infrastructure and governance remain the primary bottlenecks to scaling AI. While generic platform proxies like CAEVES provide a baseline, they are often insufficient for the specific demands of healthcare data integrity. Rhapsody’s approach suggests that the next phase of infrastructure maturity will be defined by tools that understand the domain-specific context of the data they protect.
Sagnik Bhattacharya, CEO of Rhapsody, summarized the operational shift: “CIOs are under pressure to advance AI initiatives while maintaining control of sensitive healthcare data. They need to know which agents are accessing their systems, what those agents are allowed to do and whether they stay within those boundaries. Guardian puts their decisions into practice, helping health systems move from AI policy to controlled deployment.” By embedding compliance and governance directly into the agent runtime, Rhapsody is positioning its infrastructure to support the next generation of clinical AI applications.
