Content
authorization
for AI agents.
Axtary checks the exact diff, message, query, or tool payload before a connector executes. Routine actions follow policy; higher-risk actions require approval of that exact payload.
If an agent is mistaken or compromised, its authority remains limited to the approved action. Every attempt is recorded.
Change the payload. Verification fails.
Human approval is bound to the reviewed payload hash. If the payload changes after approval, adapter-side verification rejects the mismatch before the provider is called. The approved and presented hashes are recorded in the ledger.
The signed pass is bound to the approved action. The ledger preserves the verification record.
Reproduce locally: axtary run workflow github-pr-review --real --tamper
Approval is bound to the payload, not a summary.
ActionPass is designed for security review and use across SDKs, proxies, and MCP wrappers. Human approval signs the normalized action and payload hash, preventing authorization from changing after review. The result is authorization for a specific action, rather than broad permission to use a tool.
{
"action_pass_id": "ap_01JAXTARY",
"agent_id": "agent:codex-prod",
"human_owner": "user:reviewer@company.com",
"intent": "Open a PR for AXT-418",
"tool": "github.pull_requests.create",
"resource": "repo:company/web-app",
"constraints": {
"base_branch": "main",
"max_files_changed": 12,
"blocked_paths": ["infra/prod/**", ".env*"],
"requires_tests": true
},
"expires_in": "10m",
"payload_hash": "sha256:7f32...",
"policy": "cedar+rego:pass",
"ledger_hash": "sha256:b9a1..."
}permit (
principal == Agent::"codex-prod",
action == Action::"github.pull_requests.create",
resource == Repo::"company/web-app"
) when {
context.intent.task_id == "AXT-418" &&
context.payload.max_files_changed <= 12 &&
!context.payload.touches_production
};Connectors and runtimes
Govern MCP servers and supported native connectors through the same policy, ActionPass, and ledger, inside the runtimes your teams already use.
Enforcement runs beside the agent. Teams coordinate through the hosted control plane.
Start with the CLI, then install only the runtime packages your integration needs.
Install Axtary where agents run. SDKs and the local proxy enforce action policy before tools execute. The hosted app coordinates approvals, policies, and audit exports.
The ActionPass draft and verifier are public artifacts:read the spec and verifier guide.