Axtary: Content Authorization System for AI Agents

Axtary is a content authorization system designed to gate what AI agents can do by verifying exact payloads before execution. Instead of granting agents broad permissions to use tools, Axtary requires human approval of the specific action and data—whether a code change, infrastructure modification, Slack message, or data query. Routine, low-risk actions follow deterministic policy automatically. Higher-risk actions pause and request human review of the exact payload; approval is cryptographically bound to that payload hash, so if an agent or attacker attempts to modify the action after review, verification fails and the operation is rejected.

The system covers security-sensitive operations across multiple domains: code changes via GitHub pull requests (with branch, file, and path constraints); infrastructure modifications to AWS and GCP resources (scoped by project, bucket, region, and prefix); Slack messages (with channel scope and recipient step-up); Linear and Jira issue updates (with project, assignee, status, and field constraints); Google Drive and document searches (with root, result, byte, and traversal limits); and MCP tool calls (bound to server identity and tool definition hash). Every attempt is logged in an audit ledger, preserving both the approved payload hash and the hash of the payload presented at execution time.

Axtary's architecture keeps enforcement and credentials local. SDKs and a local proxy enforce action policy before tools execute; credentials remain on the agent's side and never transit the hosted control plane. The hosted component coordinates team policy, approval workflows, and audit exports without accessing the sensitive action data itself. The platform integrates with multiple AI agent runtimes—Anthropic, OpenAI, and Cursor—and supports both Model Context Protocol (MCP) servers and native connectors to GitHub, Slack, Linear, Jira, Sentry, PostgreSQL, AWS, Google Cloud, and Google Drive. Microsoft, Okta, and Auth0 connectors are coming soon. The ActionPass draft and verifier are published as public artifacts for security review. Axtary is available at v0.5.0 under the Apache-2.0 license on npm.

Axtary addresses a growing concern in AI agent deployment: the tension between capability and control. As agents take on sensitive tasks—committing code, updating infrastructure, posting to company channels, querying databases—the permission model becomes critical. Traditional tool-based access control grants broad permissions (e.g., "use Slack" or "write to GitHub") with limited visibility into what each invocation actually does. Axtary inverts this by enforcing authorization at the payload level: not "can the agent use GitHub?", but "is this exact pull request diff what the human reviewed and approved?"

The platform's architecture separates concerns deliberately. Local enforcement and credential storage mean sensitive operations never transit a central server in the approval path; the hosted control plane only orchestrates policy, review workflows, and audit trails. This design reduces the blast radius if the hosted service is compromised—an attacker cannot directly trigger privileged actions without local verification. Axtary's support for both MCP (Model Context Protocol) servers and native connectors to mainstream platforms (GitHub, Slack, AWS, Google Cloud) suggests it aims to fit into existing AI agent runtimes without requiring architectural rewrites.

No comments yet. Be the first to share your thoughts!