Approving every tool call does not scale — Anthropic measured that Claude Code users approve 93% of permission prompts, and permission fatigue is what that number describes. Decionis replaces the prompt with policy-based gating: a deterministic control plane between an agent's intent and its execution, where every consequential action — a purchase, a tool call, a deploy, a refund — is evaluated against your policy first, and every verdict ships with a signed Decision Dossier you can verify independently.
Priced on governed actions, not revenue — see the Build plan.
One call before the action commits: POST the intent, get ALLOW, ESCALATE, or BLOCK in <120ms, deterministically — the same inputs always produce the same verdict. Every decision returns a signed Decision Dossier anyone can verify without trusting us.
A GitHub template that binds agent tool calls to authority before they run: one immutable agent-safe.intent/1 binding captured per action, evaluated against policy, enforced by native PreToolUse hooks — outside the model's discretion, so a persuaded agent still can't skip the gate.
On npm today. Decionis is built to be discovered and operated by the very agents it governs: a local stdio MCP server puts the policy gate inside Claude Code, Codex, and Cursor without sending anything off the machine — ask your agent to run decionis_demo for a verdict in under a minute, no account and nothing to approve — and the hosted OAuth connector gives Claude and ChatGPT the same permission step in one approval.
The same permission step, wherever your agents already run.
Connect the hosted Decionis connector with one OAuth approval and Claude asks before it acts — authority evaluations, Shadow Mode checks, and signed records in the conversation.
Connect ClaudeThe same hosted connector gives ChatGPT a permission step: every governed request returns a verdict and a signed record you can verify.
Connect ChatGPTThe Decionis extension puts live decision visibility and offline Ed25519 verification of signed records inside Docker Desktop, for agents running in containers.
884 pulls on Docker Hub as of 26 Aug 2026
Install from Docker HubThe local stdio MCP server puts the policy gate inside the coding-agent loop, evaluated on your machine with nothing sent off it. Native PreToolUse hooks enforce outside the model's discretion.
MCP quickstartClaiming your workspace. An agent — or the Docker Desktop extension — can mint a provisional workspace with no human in the loop. Until it is claimed it runs on a synthetic identity, and every dossier it produces carries a signed provisional-anonymous watermark so verifiers can tell it from an owned org's record. The mint response advertises the claim endpoints: authenticated with the workspace's own API key, they issue a claim token your operator finishes in the browser — and the key plus the full dossier ledger survive into the claimed account.
Prompt-level guardrails decide what a model may say. Decionis decides what an agent may do — deterministically, outside the model's discretion, with the evidence recorded before execution. If the verdict is ESCALATE, the action holds until a human approves; if it's BLOCK, it never runs; either way the signed record exists.
Same action, same policy, same verdict — reproducible in audit, not probabilistic.
The gate sits between intent and execution, so the outcome can still change.
Every verdict is a signed Decision Dossier verifiable without trusting us.
Deep dives: AI agent governance · MCP security · Agent guardrails in production
The sandbox is the real evaluator with a real signing key. Attack it. Every refusal comes back as a signed dossier naming the rule that stopped you.
Run the sandbox — no account required