decionis/agent-safe-pipeline

Reference architecture for AI agents that propose actions but cannot authorize them — immutable intent capture, an independent Decionis policy verdict (ALLOW/ESCALATE/BLOCK), verified human approval, and a SafeExecutor that consumes a single-use intent-bound grant.

What it solves

AI agents often have too much autonomy or lack a secure way to handle privileged actions. This project provides a reference architecture to ensure that agents can propose actions, but an independent authorization boundary decides whether those actions are actually executed.

How it works

The system separates the agent's proposal from the actual execution through a multi-step pipeline:

  1. Intent Capture: The agent proposes an action (intent), which is captured as an immutable record.
  2. Independent Decision: A gate (Decionis) evaluates the intent against a policy to determine if it should be ALLOWED, BLOCKED, or ESCALATED for human approval.
  3. Human Verification: If escalated, a human verifies the intent via a Presence service.
  4. Safe Execution: A SafeExecutor runs the action using a sealed ActionRegistry that maps action names to trusted handlers, ensuring the agent never possesses the actual credentials or determines the handler used.

Who it’s for

Developers building AI agents that need to perform sensitive operations (like processing refunds or deploying code) where strict authorization and human-in-the-loop oversight are required.

Highlights

  • Immutable Intent: Prevents agents from altering their proposal after it has been evaluated.
  • Trust Boundary: Keeps privileged credentials behind a trusted executor, away from the agent.
  • Fail-Closed Design: Network errors or malformed responses result in a block by default.
  • Reference Implementations: Includes examples for Shopify refunds, GitHub deployments, and MCP tool gating.

Related

  • Project
    MORTEN-BUUR/nordef-matrix-open-control

    A model-independent safety control plane for AI agents that enforces deterministic policies and cryptographic human approval outside the language model.

  • Project
    provos/ironcurtain

    A secure runtime for autonomous AI agents that converts human-readable constitutions into deterministic security policies to prevent unauthorized system access.

  • Project
    workos/auth.md

    A reference implementation of the agentic registration protocol, enabling AI agents to authenticate with services on behalf of users via identity assertions and claim ceremonies.

  • Project
    Kritt-ai/open-kritt

    An open-source security research platform that orchestrates AI agents to find, validate, and rank vulnerabilities in code through focused, parallelized workflows.

  • Project
    microsoft/agent-governance-toolkit

    A governance framework for autonomous AI agents that provides deterministic policy enforcement, identity management, and audit logging to prevent unauthorized actions.