Show HN: Axtary – Content Authorization for AI Agents

authorization

for AI agents.

Axtary checks the exact diff, message, query, or tool payload before a connector executes. Routine actions follow policy; higher-risk actions require approval of that exact payload.

If an agent is mistaken or compromised, its authority remains limited to the approved action. Every attempt is recorded.

Tokens authorize channels. Axtary authorizes content. #

Axtary governs security-sensitive engineering and agent operations, including code changes, infrastructure paths, data access, messages, tickets, documents, and MCP tools. Enforcement runs beside the agent so provider credentials remain local. Routine actions follow deterministic policy. Higher-risk actions require approval of the exact payload.

Change the payload. Verification fails. #

Human approval is bound to the reviewed payload hash. If the payload changes after approval, adapter-side verification rejects the mismatch before the provider is called. The approved and presented hashes are recorded in the ledger.

The signed pass is bound to the approved action. The ledger preserves the verification record.

Reproduce locally: axtary run workflow github-pr-review --real --tamper

Approval is bound to the payload, not a summary. #

ActionPass is designed for security review and use across SDKs, proxies, and MCP wrappers. Human approval signs the normalized action and payload hash, preventing authorization from changing after review. The result is authorization for a specific action, rather than broad permission to use a tool.

{
  "action_pass_id": "ap_01JAXTARY",
  "agent_id": "agent:codex-prod",
  "human_owner": "user:reviewer@company.com",
  "intent": "Open a PR for AXT-418",
  "tool": "github.pull_requests.create",
  "resource": "repo:company/web-app",
  "constraints": {
    "base_branch": "main",
    "max_files_changed": 12,
    "blocked_paths": ["infra/prod/**", ".env*"],
    "requires_tests": true
  },
  "expires_in": "10m",
  "payload_hash": "sha256:7f32...",
  "policy": "cedar+rego:pass",
  "ledger_hash": "sha256:b9a1..."
}
permit (
  principal == Agent::"codex-prod",
  action == Action::"github.pull_requests.create",
  resource == Repo::"company/web-app"
) when {
  context.intent.task_id == "AXT-418" &&
  context.payload.max_files_changed <= 12 &&
  !context.payload.touches_production
};

Connectors and runtimes

Govern MCP servers and supported native connectors through the same policy, ActionPass, and ledger, inside the runtimes your teams already use.

Enforcement runs beside the agent. Teams coordinate through the hosted control plane. #

Install Axtary where agents run. SDKs and the local proxy enforce action policy before tools execute. The hosted app coordinates approvals, policies, and audit exports.

The ActionPass draft and verifier are public artifacts:read the spec and verifier guide.

npm i -g @axtary/cli && axtary init && axtary demo

• proxy · SDKs

• policy · ledger

• credential broker

• approval inboxes

• policy registry

• audit exports

Enforcement and credentials remain local. The hosted control plane coordinates team policy and review without entering the action data path.

policy:
  github:
    pullRequests:
      requiredBaseBranch: main
      maxFilesChanged: 12
      denyPathPrefixes: [.env, secrets/]
      stepUpPathPrefixes: [infra/prod/, billing/]
      requiresTests: true
  slack:
    messages:
      allowedChannels: ["#axtary-dev"]

Apache-2.0 · v0.5.0 on npm