Runtime authorization · open source
Your agent asks before it acts and gets back a receipt: who authorized this, what exactly, under what information flow. An auditor checks it offline with a public key — no account, no access to your systems, and no way to forge one.
Nothing here is recorded or simulated. The digest is recomputed in your browser with the same SHA-256 and the same canonicalization the server uses.
What it refuses
What stops exfiltration is whether this data may reach this destination. Every line below is transcribed from the engine, not written for the page.
read /tickets/8842.txt PERMIT integrity -> UNTRUSTED session now carries content the agent did not authorsend /outbox/reply.txt to customer@ourcompany.com PERMIT destination was declared at registrationsend /outbox/reply.txt to attacker@evil.com DENY FLOW_VIOLATION:INTEGRITY:UNDECLARED_DESTINATION this send is addressed to 'attacker@evil.com', which the agent never declared, and its session carries content it did not author
read /hr/salary_2026.xlsx PERMIT watermark -> SECRETexport /public/summary.pdf DENY SECRET_TO_PUBLIC
fetch https://feed.example.com/itemsread /hr/employees.csvsend /webhooks/notify DENY KILL_CHAIN:LETHAL_TRIFECTA
Integrating
On each call it authorizes with the full operation, recomputes the digest locally before dispatch, spends the receipt, then runs the body. If anything changed in between, the body does not run.
Binding every argument is the default because the alternative is the bug. A transfer(account, amount, recipient) guarded only on account authorizes any amount to anyone — the confused-deputy gap that arXiv 2606.28679 pins on LangChain, LlamaIndex and the Stripe Agent Toolkit.
from agentgate import AgentGate gate = AgentGate("https://pdp.internal", api_key=KEY)gate.register( agent_id="pay_bot", declared_purpose="Pay approved suppliers", authorized_resources=["/payments/*"], authorized_actions=["transfer"], allowed_destinations=["/payments/*"],) @gate.guard("transfer", resource_arg="account")def transfer(account: str, amount_minor: int, recipient: str): ...
Why now is not a forecast
Article 12 of the EU AI Act applied from 2 August 2026: automatic recording of events across the lifecycle, and under Article 26 the deployer keeps those logs for at least six months. Up to €15M or 3% of worldwide turnover.
12%
of IT leaders say they can actually govern the agents they have deployed, against 51% who have agents in production.
OutSystems, 1,900 respondents
40%
of enterprises will demote or decommission an autonomous agent by 2027 over governance gaps found after an incident.
Gartner
6 months
minimum retention on the deployer, and a log written after the fact by the system being questioned is not what an auditor is asking for.
EU AI Act, Article 26
Insurers arrived at the same requirement from the other side. AIUC-1 now operates as a managing general agent with Beazley paper, and what they ask for is proof, at claim time, that you did what you said you did. A receipt sealed before the action answers that. A log assembled afterwards does not.
Drop-in integration. No framework changes. No rewrites.
from agentgate import AgentGate gate = AgentGate("http://localhost:8000", api_key="your-key")gate.register( "my_bot", "ReportBot", "Summarize quarterly business reports", authorized_resources=["/reports/*"], authorized_actions=["read"],) # Authorize before each action — PERMIT | ESCALATE | DENYresult = gate.authorize("read", "/reports/q3.pdf") # Or use the decorator — enforcement is automatic@gate.guard("read", resource_arg="path")def read_document(path: str) -> str: return open(path).read()
We're onboarding select enterprise pilot teams with limited availability.
Priority given to teams running LangGraph, LangChain, or custom agent frameworks in production with real compliance requirements.
Dedicated onboarding
1:1 setup with the founding team
Pilot pricing
Flexible pricing for early adopters
Direct influence
Shape the roadmap with your use case
We'll reach out within 24 hours to schedule your onboarding call.