Authentication, authorization, and audit for every principal — human or agent. Authorize the action, not just the session, and keep signed proof of all of it.
Agents act on people's behalf and autonomously. Login-plus-coarse-scopes was never meant for software that takes actions — and the credential is the wrong place to catch a redirected one.
Human auth — sessions, OAuth/SSO, passkeys — plus agent identity, where every agent is a first-class principal with its own scoped, revocable credentials.
Fine-grained, policy-based authorization down to the individual action — with constraints, intent-binding, and human approval for sensitive operations.
Full-stack visibility and tamper-evident proof of every access and action — who or what did what, when, and under whose authority — exportable as evidence.
The agent proposes; delego decides — deterministically, with no model in the path — parks sensitive actions for a human, and signs a receipt either way.
One small, deterministic, Apache-2.0 library. No LLM in the decision path, no credential custody — it rides your existing broker instead of replacing it.
# first match wins · fail-closed rules: - name: place-order decision: needs_approval match: { method: POST, path: /orders } constraints: amount: { field: amount, max: 5000, currency: USD } allow_list: { field: destination, in: [internal] } default: deny # anything not allowed is refused
Who or what did what, when, and under whose authority — a tamper-evident, hash-chained ledger you can verify and export as compliance evidence.
The firewall and the spec are open source forever. Bring the hosted control plane when you're ready.