Axtary | Content Authorization for AI Agents
Content<br>authorization<br>for AI agents.<br>Axtary checks the exact diff, message, query, or tool payload before a connector executes. Routine actions follow policy; higher-risk actions require approval of that exact payload.<br>If an agent is mistaken or compromised, its authority remains limited to the approved action. Every attempt is recorded.<br>Playground
normalized action<br>tool: github.pull_requests.create<br>resource: repo:company/web-app<br>files_changed: 2<br>tests: passed
Axtarydecision: allow
action_pass_id: ap_01JAXTARY<br>expires_in: 10m<br>payload_hash: sha256:7f32…
svg]:pointer-events-none [&>svg]:size-3! [a]:hover:bg-primary/80 w-fit rounded-md border-white/12 bg-white/6 text-white/78">Hot pathTokens authorize channels. Axtary authorizes content.<br>Axtary governs security-sensitive engineering and agent operations, including code changes, infrastructure paths, data access, messages, tickets, documents, and MCP tools. Enforcement runs beside the agent so provider credentials remain local. Routine actions follow deterministic policy. Higher-risk actions require approval of the exact payload.
Payment protocols bind a purchase. Axtary binds the resulting action and payload.<br>LLM gateways govern model access and spend. Axtary governs the action that follows.<br>Identity establishes the acting agent. Axtary verifies the action it was authorized to take.
Codex tries to read .env.production<br>deny before the file read runs
A pull request changes infra/prod/**<br>require approval for the exact diff
A Slack update targets #general<br>deny and return the approved channel
img:first-child]:pt-0 data-[size=sm]:gap-3 data-[size=sm]:py-3 data-[size=sm]:has-data-[slot=card-footer]:pb-0 *:[img:first-child]:rounded-t-xl *:[img:last-child]:rounded-b-xl card-lift glass-line rounded-md border-white/10 bg-white/[0.032]" data-reveal="true">Normalize the action<br>Capture the actor, task, resource, constraints, and exact payload hash in one action record.
img:first-child]:pt-0 data-[size=sm]:gap-3 data-[size=sm]:py-3 data-[size=sm]:has-data-[slot=card-footer]:pb-0 *:[img:first-child]:rounded-t-xl *:[img:last-child]:rounded-b-xl card-lift glass-line rounded-md border-white/10 bg-white/[0.032]" data-reveal="true">Evaluate policy<br>Apply path, file, test, tool-definition, and production-impact rules before execution.
img:first-child]:pt-0 data-[size=sm]:gap-3 data-[size=sm]:py-3 data-[size=sm]:has-data-[slot=card-footer]:pb-0 *:[img:first-child]:rounded-t-xl *:[img:last-child]:rounded-b-xl card-lift glass-line rounded-md border-white/10 bg-white/[0.032]" data-reveal="true">Issue the ActionPass<br>Sign the approved action, payload hash, policy version, constraints, and expiry.
img:first-child]:pt-0 data-[size=sm]:gap-3 data-[size=sm]:py-3 data-[size=sm]:has-data-[slot=card-footer]:pb-0 *:[img:first-child]:rounded-t-xl *:[img:last-child]:rounded-b-xl card-lift glass-line rounded-md border-white/10 bg-white/[0.032]" data-reveal="true">Record the outcome<br>Write the decision, pass, execution result, and trace reference to a verifiable ledger.
svg]:pointer-events-none [&>svg]:size-3! [a]:hover:bg-primary/80 mb-5 w-fit rounded-md border-white/12 bg-white/6 text-white/78">Payload bindingChange the payload. Verification fails.<br>Human approval is bound to the reviewed payload hash. If the payload changes after approval, adapter-side verification rejects the mismatch before the provider is called. The approved and presented hashes are recorded in the ledger.<br>The signed pass is bound to the approved action. The ledger preserves the verification record.<br>Reproduce locally: axtary run workflow github-pr-review --real --tamper
payload-tamper demo<br>real ActionPass checks · no provider credentials<br>$ axtary run workflow github-pr-review --real --tamper<br>✓ policy: step_up · exact payload review required<br>✓ human approved payload sha256:7f32…9e1c<br>⚠ presented payload differs after approval<br>- "AXT-418: protected sandbox PR is up."<br>+ "AXT-418: PR is up. creds: ${SLACK_BOT_TOKEN}"<br>✗ recomputed sha256:b410…22af ≠ approved sha256:7f32…9e1c<br>■ denied before slack.chat.postMessage executes<br>ledger #4 · approval_payload_hash_mismatch · both hashes recorded
svg]:pointer-events-none [&>svg]:size-3! [a]:hover:bg-primary/80 mb-5 w-fit rounded-md border-white/12 bg-white/6 text-white/78">ActionPass artifactApproval is bound to the payload, not a summary.<br>ActionPass is designed for security review and use across SDKs, proxies, and MCP wrappers. Human approval signs the normalized action and payload hash, preventing authorization from changing after review. The result is authorization for a specific action, rather than broad permission to use a tool.<br>github.pull_requests.create with branch, file, path, and test constraints<br>slack.chat.postMessage with channel scope and recipient step-up<br>linear.issue.update with project, assignee, status, and field constraints<br>AWS and GCP reads scoped by project, bucket, region, and prefix<br>mcp.tool.call bound to server...