{"slug": "what-is-workos-airlock-intent-based-access-control-for-ai-agents", "title": "What is WorkOS Airlock? Intent-based access control for AI agents", "summary": "WorkOS launched Airlock in early access, an intent-based access control system that evaluates AI agent actions against declared intent and configured policies before API calls proceed. In a demo by Aaron Tainter, Airlock blocked an agent from emailing LLM token-spend figures under a financial-data policy, while a send to a previously unused distribution list required Slack approval from an IT admin. Airlock sits between the agent and WorkOS Pipes, which manages provider OAuth credentials, so the agent receives an Airlock token tied to its intent rather than direct access to credentials.", "body_md": "# What is WorkOS Airlock? Intent-based access control for AI agents\n\nWhat is WorkOS Airlock? See how intent-based access control governs AI agent calls, where Pipes fits, and how the email demo turns policy into action.\n\nAn agent can read a confidential planning issue in Linear and email it to the wrong audience using two valid API calls. As agents take on work across company systems, authorization needs to account for how they use that access. [WorkOS Airlock](https://workos.com/airlock) evaluates agent actions against their intent and your policies before the calls proceed.\n\nThis guide uses [Aaron Tainter's Agent Night demo](https://workos.com/blog/agent-night-recap-airlock-intent-based-access-control) to explain where Airlock fits, what it checks, and what your application still controls. Airlock is [available in early access](https://workos.com/airlock) if you want to apply this approach to your agents.\n\n## Where Airlock sits between an agent and your tools\n\nIn the demo, the agent read Linear issues and sent email through Gmail. [WorkOS Pipes](https://workos.com/docs/pipes) supplied those provider connections and managed their OAuth credentials. Airlock sat between the agent and Pipes to decide which calls could proceed.\n\nThe agent received an Airlock token associated with its declared intent. It used that token to make governed calls; the Gmail credential stayed behind the gateway. Pipes handled the connection, while Airlock checked the proposed action. Gmail or Linear then executed calls that passed those checks.\n\nThat separation matters when a connection has broad permissions. The connected account might be able to delete mail, but an Airlock policy can prohibit the agent from using that ability. The provider's permissions still limit what the account can do. Airlock adds restrictions for the agent's use of it.\n\n## Intent gives the task context; policy sets the limits\n\nConsider the assignment from the demo: read the planning issues in Linear and email an update to the manager. The intent explains why the agent is reading issues and preparing a message. The policy determines which operations and contents are acceptable while it does that work.\n\nAaron wrote the Gmail policy in natural language. Airlock's Rule Builder translated it into fixed rules for API operations and runtime checks for requirements such as prohibiting financial information in outgoing email. He could inspect the generated policies before creating the rules.\n\nDeclaring an intent does not grant an exception to those policies. An agent saying that a message is authorized, or that its recipient has already been approved, does not establish those facts. Airlock's runtime checks can consult relevant context, such as mailbox history, when a policy needs it. The [guide to defining agent intent](https://workos.com/blog/define-ai-agent-intent) explains this trust boundary.\n\n## What changed in the email demo\n\nA routine planning update went through: the agent read the issues and emailed the manager. When another task asked it to summarize an issue containing LLM token-spend figures, Airlock blocked the send under the financial-data policy. Reading the issue was permitted; disclosing its contents in that email was prohibited.\n\nA third task involved a distribution list the mailbox had not used before. Airlock requested approval from an IT admin. Aaron approved the request in Slack, and the email was sent. Those outcomes followed the policy he configured for the demo; another organization would define its own rules.\n\nWatch Aaron build the rules and run the examples:\n\nThe [email approval workflow guide](https://workos.com/blog/ai-agent-approval-policies-airlock) follows the pause and retry in detail, including how approval stays tied to the request.\n\n## What to establish before connecting your agent\n\nIdentify the operations the agent needs and route them through Airlock with policy enforcement enabled. Keep direct provider credentials out of the agent's environment; a second route to Gmail would let it bypass the policy checks.\n\nThen test both the permitted work and the actions that should stop. Check the provider result as well as Airlock's decision: permission to send does not prove that Gmail delivered the message, and an allowed summary can still be inaccurate. The [Airlock pilot guide](https://workos.com/blog/airlock-pilot-internal-ai-agents) walks through that evaluation.\n\n[Request Airlock early access](https://workos.com/airlock) with a workflow you want to delegate and the rules it needs to follow.", "url": "https://wpnews.pro/news/what-is-workos-airlock-intent-based-access-control-for-ai-agents", "canonical_source": "https://workos.com/blog/workos-airlock", "published_at": "2026-09-23 16:46:32+00:00", "updated_at": "2026-09-23 17:00:21.219656+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-products", "ai-policy", "developer-tools"], "entities": ["WorkOS", "WorkOS Airlock", "WorkOS Pipes", "Aaron Tainter", "Linear", "Gmail", "Slack"], "alternates": {"html": "https://wpnews.pro/news/what-is-workos-airlock-intent-based-access-control-for-ai-agents", "markdown": "https://wpnews.pro/news/what-is-workos-airlock-intent-based-access-control-for-ai-agents.md", "text": "https://wpnews.pro/news/what-is-workos-airlock-intent-based-access-control-for-ai-agents.txt", "jsonld": "https://wpnews.pro/news/what-is-workos-airlock-intent-based-access-control-for-ai-agents.jsonld"}}