Approving every tool call does not scale — Anthropic measured that Claude Code users approve 93% of permission prompts, and permission fatigue is what that number describes. Replace the prompt with your policy: every consequential action, whether a purchase, a tool call, a deploy or a refund, is checked against it before it executes, the same way every time. Every decision comes with a signed Decision Dossier you can verify yourself.
Priced on governed actions, not revenue — see the Build plan.
Your agent arrives capable. You give it the context, the tools and the steps of the job. Give it the rest of day one too: what it may do alone, who approves the rest, a trial period, and a record of its work.
Refunds up to $200, price changes within 5%, no payment to a bank account changed this month. Start from a policy pack, or approve the one we propose from your own history (Walmart in Beta, Business Central in Private beta).
Anything over the limit waits for the person you name, in Teams, Slack or your workspace. When your policy asks for it, Presence verifies that person for that exact action.
Shadow mode records what your agent would have done and what your policy would have said, without blocking anything. Turn on enforcement for one action when the record looks right.
Every decision is a signed Decision Dossier: what was asked, which rule answered, who approved. Your auditor checks it offline, without asking us.
One call before the action commits: POST the intent, get ALLOW, ESCALATE, or BLOCK, deterministically — the same inputs always produce the same verdict. Every decision returns a signed Decision Dossier anyone can verify without trusting us.
The open reference implementation of the execution contract: one immutable agent-safe.intent/1 binding captured per action, evaluated by Decionis, run only on a claimed single-use grant — as a library, as the AgentSafe gateway in front of any agent or API, and as Govern, the gate for CI workflows — outside the model's discretion, so a persuaded agent still can't skip the gate.
On npm today. A local stdio MCP server puts the policy gate inside Claude Code, Codex, and Cursor without sending anything off the machine — ask your agent to run decionis_demo for a verdict in under a minute, no account and nothing to approve — and the hosted OAuth connector gives Claude and ChatGPT the same permission step in one approval.
The same permission step, wherever your agents already run.
Connect the hosted Decionis connector with one OAuth approval and Claude asks before it acts — authority evaluations, Shadow Mode checks, and signed records in the conversation.
Connect ClaudeThe same hosted connector gives ChatGPT a permission step: every governed request returns a verdict and a signed record you can verify.
Connect ChatGPTThe Decionis extension puts live decision visibility and offline Ed25519 verification of signed records inside Docker Desktop, for agents running in containers.
Install from Docker HubThe local stdio MCP server puts the policy gate inside the coding-agent loop, evaluated on your machine with nothing sent off it. Native PreToolUse hooks enforce outside the model's discretion.
MCP quickstartClaiming your workspace. An agent — or the Docker Desktop extension — can mint a provisional workspace with no human in the loop. Until it is claimed it runs on a synthetic identity, and every dossier it produces carries a signed provisional-anonymous watermark so verifiers can tell it from an owned org's record. The mint response advertises the claim endpoints: authenticated with the workspace's own API key, they issue a claim token your operator finishes in the browser — and the key plus the full dossier ledger survive into the claimed account.
Prompt-level guardrails decide what a model may say. Your policy decides what an agent may do: the same way every time, outside the model's discretion, with the evidence recorded before execution. If the verdict is ESCALATE, the action holds until a human approves; if it's BLOCK, it never runs; either way the signed record exists.
Same action, same policy, same verdict — reproducible in audit, not probabilistic.
The gate sits between intent and execution, so the outcome can still change.
Every verdict is a signed Decision Dossier verifiable without trusting us.
Deep dives: AI agent governance · MCP security · Agent guardrails in production · Human-in-the-loop for MCP agents
The sandbox is the real evaluator with a real signing key. Attack it. Every refusal comes back as a signed dossier naming the rule that stopped you.
Run the sandbox — no account required