LangChain.js / LangGraph.js
@decionis/langchain
Wrap every mutation-capable tool; blocking verdicts short-circuit before invocation.
AI-optimized reference vault
Deterministic agent authorization
A fail-closed execution boundary that captures one exact agent intent, evaluates policy, and grants authority for that exact downstream mutation at most once.
The fail-closed invariant
- 01
Capture and hash one exact agent-safe.intent/1 binding before evaluation.
- 02
Only ALLOW may mint a short-lived, intent-bound Ed25519 grant.
- 03
Atomically consume that grant immediately before one downstream mutation.
BLOCK, ESCALATE, REVIEW_REQUIRED, errors, expiry, replay, store failure, and binding mismatch authorize nothing. Token verification alone never authorizes execution because it does not consume the grant.
Immutable intent capture
This example carries a real canonical SHA-256 for the binding shown. The expiry is one minute after capture and inside the protocol's five-minute maximum.
{
"protocol_version": "agent-safe.intent/1",
"tenant_id": "00000000-0000-4000-8000-000000000001",
"intent_id": "00000000-0000-4000-8000-000000000002",
"captured_at": "2026-08-15T12:00:00.000Z",
"expires_at": "2026-08-15T12:01:00.000Z",
"actor": {
"id": "refund-agent",
"type": "ai-agent",
"runtime": "langchain",
"trust_level": "service"
},
"action": {
"type": "refund_order",
"resource": "shopify:order:58291",
"parameters": {
"amount": 350,
"currency": "USD"
}
},
"context": {
"campaign": "reference-vault",
"customer_tier": "standard"
},
"downstream_target": {
"system": "shopify",
"operation": "refund",
"endpoint": "/admin/api/2026-07/orders/58291/refunds.json"
},
"intent_hash": "sha256:b26e308e446057281f305332790935ad95b5f2f87d1c89e7c08c54178ba236a4",
"mode": "ENFORCEMENT"
}Canonical authorization sequence
| Endpoint | Authority |
|---|---|
| POST /v1/authority/enforce-and-bind | Recompute the canonical intent hash, evaluate policy, and mint a grant only for ALLOW. |
| POST /v1/execution/verify-token | Inspect signature and binding without authorizing execution. |
| POST /v1/execution/consume-token | Atomically redeem the exact grant once immediately before mutation. |
Framework enforcement boundaries
The decisive question is whether the check sits outside model discretion and directly before the mutation. Discovery is useful; only a binding execution boundary enforces.
CrewAI
decionis-crewai Python adapter
Wrap each mutation-capable BaseTool; BLOCK, REVIEW_REQUIRED, ESCALATE, and ERROR stop the inner tool.
AutoGen Core / AutoGen 0.2
decionis-autogen Python adapter
Wrap current BaseTool instances or use the legacy UserProxyAgent interception hook before function execution.
Claude Code, Codex, and GitHub Copilot
@decionis/mcp native PreToolUse hooks
Install the native hook so enforcement occurs outside model discretion.
Claude Desktop and MCP clients without binding hooks
@decionis/mcp discovery tools
MCP tools are advisory unless the host routes mutations through an external execution-authority gateway.
Ed25519-signed evidence
No fabricated signature is presented as proof. Use the live verification page or the offline verifier against the public JWKS to verify a real Decision Dossier.
{
"example_kind": "verification-contract-not-a-live-signature",
"canonicalization": "Recursively sort object keys using ECMAScript UTF-16 code-unit ordering, then JSON.stringify the result as UTF-8.",
"digest": "SHA-256",
"signature": "Ed25519",
"public_jwks": "https://api.decionis.com/v1/.well-known/decision-dossier-jwks.json",
"execution_grant_jwks": "https://api.decionis.com/v1/.well-known/decionis-execution-grant-jwks.json",
"live_verification": "https://decionis.com/verify/decision-dossiers",
"offline_verifier": "npx -y @decionis/verify <dossier-url-or-json-file>",
"checks": [
"Select an OKP/Ed25519 JWK whose kid matches the proof bundle key_id.",
"Recompute each portable artifact's canonical SHA-256 digest.",
"Verify every detached Ed25519 signature over those canonical UTF-8 bytes.",
"Reject missing, mismatched, malformed, or unverifiable proof."
]
}