Loading…
AgentSafe
Put an authority boundary in front of any agent or API.
Point the agent at AgentSafe instead of the service. Each consequential request is captured as an intent and sent to Decionis for a decision; AgentSafe then forwards exactly that request once, holds it for a person, or refuses it, and writes a chained evidence line either way. It decides nothing itself.
- License
- Apache-2.0
- Release
- v0.3.5
- Runtime
- 0.2.5
- Checked
- 2026-09-25
Try it with no account
The boundary test sends the same consequential requests three ways at a synthetic target on your machine: directly, through the gateway in shadow, and through it in enforcement, with a local demo policy standing in for Decionis. It reads no configuration, environment or stored login, so no real service or key is involved.
agentsafe testExposure 6 of 6 adversarial actions reached the target directly, 6 of 6 in shadow, 0 of 6 under enforcement
Evidence 26 chained lines, verified
Verdict BOUNDARY HOLDS
✓ boundary testedIt refuses to run where NODE_ENV=production, which is why the Docker form clears it: docker run --rm -e NODE_ENV= ghcr.io/decionis/agentsafe:0.2.5 test. Exit 0 means the boundary held, 1 that it did not.
What happens to each request
The gateway answers with headers that say what happened, so a caller can tell a refusal from an outage: agentsafe-execution and agentsafe-state.
| When | The caller gets | Execution |
|---|---|---|
| ALLOW | The caller gets:The service's own response | Execution:FORWARDEDonce, on a single-use grant AgentSafe claims before it sends the request |
| ESCALATE | The caller gets:202 | Execution:HELDa person must decide; the hold lasts until the intent expires |
| BLOCK | The caller gets:403 | Execution:NOT_FORWARDEDthe authority refused, and the service never sees the request |
| Sent, but no answer came back | The caller gets:502 | Execution:INDETERMINATEreported as unknown, not as a success or a failure |
| Decionis unreachable, fail closed (the default) | The caller gets:503, Retry-After: 5 | Execution:NOT_FORWARDEDstate AUTHORITY_UNAVAILABLE and a null verdict, never reported as a BLOCK |
| Decionis unreachable, fail open (opt-in) | The caller gets:The service's own response | Execution:FORWARDED_UNGOVERNEDrecorded as an ungoverned execution and counted, not treated as authorized |
| Shadow mode | The caller gets:The service's own response | Execution:PASSTHROUGHthe decision is recorded, nothing is enforced |
Failing to reach Decionis is never an authorization. The failure policy is --failure-policy failClosed|failOpen (or AGENTSAFE_FAILURE_POLICY), and every forward made under fail-open is counted in agentsafe_ungoverned_forwards_total. Failure policy · Failure posture by surface
Put it in front of a service
Run it wherever the calling code runs. With no Decionis key the gateway uses the local demo authority and says so when it starts; it refuses that authority in production. Mode is --mode shadow|enforcement: with a Decionis key it starts in shadow until you choose enforcement.
npm, in front of a local service
npm install -g @decionis/agentsafe
agentsafe proxy --upstream http://localhost:3000 --port 8080Kubernetes (Helm), in shadow until gateway.mode is enforcement
helm install agentsafe oci://ghcr.io/decionis/charts/agentsafe --version 0.2.5 --namespace payments --set decionis.tenantId=<your organization id> --set upstream.service=payments --set upstream.port=8080Docker, with a Decionis key as a mounted file
mkdir -p secrets && (umask 077; printf '%s' "$DECIONIS_API_KEY" > secrets/decionis-api-key)
docker run --rm -p 8080:8080 \
-e AGENTSAFE_LISTEN=:8080 \
-e AGENTSAFE_UPSTREAM=http://host.docker.internal:3000 \
-e AGENTSAFE_UPSTREAM_INSECURE=true \
-e DECIONIS_API_KEY_FILE=/var/run/agent-safe/secrets/decionis-api-key \
-e DECIONIS_TENANT_ID=<your organization id> \
-v "$PWD/secrets:/var/run/agent-safe/secrets:ro" \
ghcr.io/decionis/agentsafe:0.2.5Linux packages, systemd, macOS and every configuration key: install guides · CLI reference
Connect it to Decionis
A free workspace, in shadow
No signup, email or card. The workspace decides in shadow only, with an allowance of 50 governed decisions a month, and the hosted test runs the same requests with Decionis deciding.
agentsafe login --provision
agentsafe test --hostedEnforcement
Enforcement needs a key from a Decionis organization, given as DECIONIS_API_KEY_FILE (a mounted file is required in production), and the organization's id as DECIONIS_TENANT_ID. Production enforcement is set up with Decionis.
Build it into your code
The gateway is built on a library you can use directly: capture the proposal as an intent, ask the authority, and run exactly what was decided.
npm install @decionis/agent-safe-pipelineconst captured = intentCapture.capture(agentProposal, trustedContext);
const decision = await gate.evaluate(captured);
const result = await executor.run(captured, decision);@decionis/agent-safe-pipeline/testing has local stand-ins for the authority and for Presence, so tests run without a network or a key; they refuse to start in production. Library README · All SDKs · Adapters
Examples
Each runs offline in a few seconds, with no credentials.
- golden-adversarial-demo
One legitimate path and eight adversarial attempts against the same boundary.
- infra-scale-demo
A valid principal scales a deployment, then tries seven ways to go past what was authorized.
- crm-outreach-demo
A CRM update and an approved outbound message, then six adversarial attempts.
- shopify-refund-agent
Refunds up to $100 allowed, $100 to $1,000 escalated, over $1,000 blocked.
- github-deploy-agent
Staging deploys allowed, production deploys escalated, force-push blocked.
- mcp-tool-gate
A real stdio MCP server whose delete_customer tool runs only on a claimed grant.
From a clone of the repository
pnpm --filter @decionis/agent-safe-example-golden-adversarial demoVerify what you run
Images, archives and packages carry build attestations; archives also ship a SHA256SUMS file. The Linux packages are not GPG-signed: their integrity comes from those two.
gh attestation verify oci://ghcr.io/decionis/agentsafe:0.2.5 --repo decionis/agent-safe-pipelineThe project
Governance
How decisions are made, who maintains it, and what needs the lead's review.
Security
Report a vulnerability privately through GitHub or to security@decionis.com.
Roadmap
What is planned next, in the repository.
Contributing
Pull requests with a DCO sign-off; the guide covers setup and review.