AgentSafe

Put an authority boundary in front of any agent or API.

Point the agent at AgentSafe instead of the service. Each consequential request is captured as an intent and sent to Decionis for a decision; AgentSafe then forwards exactly that request once, holds it for a person, or refuses it, and writes a chained evidence line either way. It decides nothing itself.

License: Apache-2.0
Release: v0.3.5
Runtime: 0.2.5
Checked: 2026-09-25

Install AgentSafe GitHub

Try it with no account

The boundary test sends the same consequential requests three ways at a synthetic target on your machine: directly, through the gateway in shadow, and through it in enforcement, with a local demo policy standing in for Decionis. It reads no configuration, environment or stored login, so no real service or key is involved.

agentsafe test

Exposure    6 of 6 adversarial actions reached the target directly, 6 of 6 in shadow, 0 of 6 under enforcement
Evidence    26 chained lines, verified
Verdict     BOUNDARY HOLDS
✓ boundary tested

It refuses to run where NODE_ENV=production, which is why the Docker form clears it: docker run --rm -e NODE_ENV= ghcr.io/decionis/agentsafe:0.2.5 test. Exit 0 means the boundary held, 1 that it did not.

What happens to each request

The gateway answers with headers that say what happened, so a caller can tell a refusal from an outage: agentsafe-execution and agentsafe-state.

When	The caller gets	Execution
ALLOW	The caller gets:The service's own response	Execution:`FORWARDED`once, on a single-use grant AgentSafe claims before it sends the request
ESCALATE	The caller gets:202	Execution:`HELD`a person must decide; the hold lasts until the intent expires
BLOCK	The caller gets:403	Execution:`NOT_FORWARDED`the authority refused, and the service never sees the request
Sent, but no answer came back	The caller gets:502	Execution:`INDETERMINATE`reported as unknown, not as a success or a failure
Decionis unreachable, fail closed (the default)	The caller gets:503, Retry-After: 5	Execution:`NOT_FORWARDED`state AUTHORITY_UNAVAILABLE and a null verdict, never reported as a BLOCK
Decionis unreachable, fail open (opt-in)	The caller gets:The service's own response	Execution:`FORWARDED_UNGOVERNED`recorded as an ungoverned execution and counted, not treated as authorized
Shadow mode	The caller gets:The service's own response	Execution:`PASSTHROUGH`the decision is recorded, nothing is enforced

Failing to reach Decionis is never an authorization. The failure policy is --failure-policy failClosed|failOpen (or AGENTSAFE_FAILURE_POLICY), and every forward made under fail-open is counted in agentsafe_ungoverned_forwards_total. Failure policy · Failure posture by surface

Put it in front of a service

Run it wherever the calling code runs. With no Decionis key the gateway uses the local demo authority and says so when it starts; it refuses that authority in production. Mode is --mode shadow|enforcement: with a Decionis key it starts in shadow until you choose enforcement.

npm, in front of a local service

npm install -g @decionis/agentsafe
agentsafe proxy --upstream http://localhost:3000 --port 8080

Kubernetes (Helm), in shadow until gateway.mode is enforcement

helm install agentsafe oci://ghcr.io/decionis/charts/agentsafe --version 0.2.5 --namespace payments --set decionis.tenantId=<your organization id> --set upstream.service=payments --set upstream.port=8080

Docker, with a Decionis key as a mounted file

mkdir -p secrets && (umask 077; printf '%s' "$DECIONIS_API_KEY" > secrets/decionis-api-key)

docker run --rm -p 8080:8080 \
  -e AGENTSAFE_LISTEN=:8080 \
  -e AGENTSAFE_UPSTREAM=http://host.docker.internal:3000 \
  -e AGENTSAFE_UPSTREAM_INSECURE=true \
  -e DECIONIS_API_KEY_FILE=/var/run/agent-safe/secrets/decionis-api-key \
  -e DECIONIS_TENANT_ID=<your organization id> \
  -v "$PWD/secrets:/var/run/agent-safe/secrets:ro" \
  ghcr.io/decionis/agentsafe:0.2.5

Compare hosting, network isolation and setup: deployment strategies. The chart, what it deploys and the image digest: Kubernetes. Linux packages, systemd, macOS and every configuration key: install guides · CLI reference

Connect it to Decionis

A free workspace, in shadow

No signup, email or card. The workspace decides in shadow only, with an allowance of 50 governed decisions a month, and the hosted test runs the same requests with Decionis deciding.

agentsafe login --provision
agentsafe test --hosted

Enforcement

Enforcement needs a key from a Decionis organization, given as DECIONIS_API_KEY_FILE (a mounted file is required in production), and the organization's id as DECIONIS_TENANT_ID. Production enforcement is set up with Decionis.

decionis.com

Build it into your code

The gateway is built on a library you can use directly: capture the proposal as an intent, ask the authority, and run exactly what was decided.

npm install @decionis/agent-safe-pipeline

const captured = intentCapture.capture(agentProposal, trustedContext);
const decision = await gate.evaluate(captured);
const result = await executor.run(captured, decision);

@decionis/agent-safe-pipeline/testing has local stand-ins for the authority and for Presence, so tests run without a network or a key; they refuse to start in production. Library README · All SDKs · Adapters

Examples

Each runs offline in a few seconds, with no credentials.

golden-adversarial-demo
One legitimate path and eight adversarial attempts against the same boundary.
infra-scale-demo
A valid principal scales a deployment, then tries seven ways to go past what was authorized.
crm-outreach-demo
A CRM update and an approved outbound message, then six adversarial attempts.
shopify-refund-agent
Refunds up to $100 allowed, $100 to $1,000 escalated, over $1,000 blocked.
github-deploy-agent
Staging deploys allowed, production deploys escalated, force-push blocked.
mcp-tool-gate
A real stdio MCP server whose delete_customer tool runs only on a claimed grant.

From a clone of the repository

pnpm --filter @decionis/agent-safe-example-golden-adversarial demo

Verify what you run

Images, archives and packages carry build attestations; archives also ship a SHA256SUMS file. The Linux packages are not GPG-signed: their integrity comes from those two.

gh attestation verify oci://ghcr.io/decionis/agentsafe:0.2.5 --repo decionis/agent-safe-pipeline

The project

Governance

How decisions are made, who maintains it, and what needs the lead's review.

GOVERNANCE.md

Security

Report a vulnerability privately through GitHub or to security@decionis.com.

SECURITY.md

Roadmap

What is planned next, in the repository.

ROADMAP.md

Contributing

Pull requests with a DCO sign-off; the guide covers setup and review.

CONTRIBUTING.md