AgentSafe

Put an authority boundary in front of any agent or API.

AgentSafe intercepts consequential actions and checks whether they are authorized before forwarding them. An agent, an application or a tool sends its HTTP request to AgentSafe instead of the target; AgentSafe captures the action as an intent, asks the Decionis control plane (the Independent Execution Authority, bound to the exact action) for a decision, and forwards exactly the authorized request once on a claimed single-use grant, holds it for a person, or refuses it, leaving a chained record of each. It decides nothing itself.

brew tap decionis/agent-safe https://github.com/decionis/agent-safe-pipeline && brew trust decionis/agent-safe && brew install agentsafe

agentsafe proxy \
  --upstream http://localhost:3000 \
  --port 8080

5-minute quickstart · Homebrew · Linux · Docker · Kubernetes · Hosted

The installed forms are produced by the release workflow from v0.2.0 on; the Homebrew formula reaches master by its own pull request after each release. The same commands run from a clone, as the quickstart shows.

The path from here is short: discover, install, test your boundary, see what is exposed, run in shadow, enforce, deploy.

The two systems behind the boundary

Arriving here for the first time, you meet three names. This repository is one of them; the other two are the services it talks to, and neither is in this repository.

• Decionis is the Independent Execution Authority, bound to the exact action: the control plane AgentSafe asks. For one captured intent it evaluates the organization's policy and answers ALLOW, ESCALATE or BLOCK; an ALLOW comes with the single-use execution grant the request executes on, an ESCALATE with the human ceremony it needs, and every decision with a signed Decision Dossier that records what was proposed, what was decided and why. It runs at decionis.com (docs); the local demo authority in this repository stands in for it on loopback with a synthetic policy, and says so on every line.
• Presence is the adaptive human verification layer. When Decionis answers ESCALATE, a verified, present person on their own device approves that exact action, and the signed Presence Record that results is evidence Decionis re-checks before it issues a grant, never authority by itself. It runs at presence.decionis.com (what the layer is); the loopback double in this repository simulates the ceremony for the examples and proves nothing about a real one.
• AgentSafe, this repository, is the execution boundary between your agent or API and those two: it captures the exact intent, asks Decionis, resolves an ESCALATE with Presence, forwards exactly the authorized request once on the claimed grant, holds or refuses the rest, and leaves chained evidence. It is Apache-2.0 and it decides nothing; OPEN-CORE.md states the seam between it and what Decionis operates.

Test your boundary

Before putting the gateway in front of anything, see what it changes. agentsafe test sends the same consequential requests three ways at a synthetic target that records what reaches it: directly, as an agent with nothing in the way; through the gateway in shadow; and through the gateway in enforcement. Nothing real is called and nothing of yours is read.

agentsafe test

                                                direct                                shadow                                                     enforcement
A read                                          reached 200                           reached 200                                                reached 200 (not consequential)
A payment within policy                         reached 201                           reached 201, would ALLOW                                   ALLOW: forwarded once, 201, dossier
A payment above the human ceiling               reached 201                           reached 201, would BLOCK                                   BLOCK 403, NOT FORWARDED
A payment above the autonomous ceiling          reached 201                           reached 201, would ESCALATE                                ESCALATE 202, HELD
Deleting a customer record                      reached 204                           reached 204, would ESCALATE                                ESCALATE 202, HELD
A forged approval on a blocked payment          reached 201, forged headers accepted  reached 201, would BLOCK                                   BLOCK 403, NOT FORWARDED
A consequential request the policy cannot read  reached 201                           reached 201, would ESCALATE                                ESCALATE 202, HELD
A payment while the authority is unreachable    reached 201                           reached 201, would decide nothing (authority unreachable)  AUTHORITY UNAVAILABLE 503, NOT FORWARDED
                                                with failurePolicy failOpen (explicit): reached 201, marked FORWARDED (fail-open, ungoverned)

Exposure    6 of 6 adversarial actions reached the target directly, 6 of 6 in shadow, 0 of 6 under enforcement
Work        routine actions went through under enforcement, once each
Evidence    26 chained lines, verified

Verdict     BOUNDARY HOLDS

The gateways under test are the ones agentsafe proxy runs, behind the same listener; the authority is the local demo policy. agentsafe test ledger=ledger.internal:443 also dials a real system of record from where you stand and says whether it answers without the gateway, which is what an agent could reach by going around. Exit 0 is a boundary that holds; 1 is exposure; --json is the report as one line. The release smoke test runs it on every packaged binary.

Five-minute quickstart

Nothing here needs an account: without a Decionis key the gateway runs a local demo authority in the same process, on loopback, with a synthetic policy, and says so on every line.

agentsafe proxy --upstream http://localhost:3000 --port 8080

AgentSafe 0.1.0

Gateway      http://127.0.0.1:8080
Upstream     http://localhost:3000
Mode         ENFORCEMENT
Authority    local/demo (synthetic policy on loopback; not Decionis)
Failure      fail-closed
Routes       none named; every unsafe method is governed
Evidence     not written; use --verbose or evidence.journalDir
Status       READY

Waiting for consequential actions...

Send it one request:

curl -i -X POST http://127.0.0.1:8080/payments -H 'content-type: application/json' -d '{"amount": 500}'

ESCALATE

POST /payments

Action       http.post
Decision     ESCALATE
Reason       HUMAN_APPROVAL_REQUIRED
Execution    HELD
Dossier      synthetic-dossier-1
Latency      4ms

The caller gets 202 and nothing reached the upstream. {"amount": 50} is ALLOW: forwarded once, byte for byte, with the dossier id beside the upstream's own answer. {"amount": 5000} is BLOCK: 403, not forwarded. A GET passes through untouched. Every state has its own heading and, with a terminal, its own color: ALLOW, BLOCK, ESCALATE, SHADOW, AUTHORITY UNAVAILABLE. --verbose shows the chained evidence lines; agentsafe init writes the configuration file; agentsafe doctor says what would stop it from governing; agentsafe login connects a Decionis key, after which the same gateway asks Decionis, in shadow first. The quickstart is the full walk, and the CLI reference every command.