Skip to content
BobSentry

Authorization before action

Decide what AI agents should be allowed to do — before they act.

Before an agent deploys code, moves money, changes data, or takes another sensitive action, BobSentry checks your rules and returns ALLOW, REQUIRE_APPROVAL, or BLOCK.

Become a design partnerWatch the demo

BobSentry makes the authorization decision. Your existing system performs the action.

LIVE API EXAMPLERuntime evaluate
POST https://runtime.bobsentry.com/v1/runtime/evaluate

{
  "action": "deploy_production",
  "metadata": {
    "environment": "production",
    "target": "github-deploy-workflow"
  }
}

→ { "decision": "REQUIRE_APPROVAL" }

The problem

Your agent can do it. Should it?

AI agents can now deploy code, issue refunds, change infrastructure, update customer data, and call sensitive APIs. Having permission to perform an action does not mean every instance of that action should proceed automatically.

Permission is not authorization.

Credentials and runtime controls can constrain what an agent is able to reach or do. Authorization determines whether this particular consequential action should proceed now.

Is this particular action authorized now?

Permissions answer

What can this agent access?

BobSentry answers

Should this action proceed right now?

Put one decision before the action.

When an agent is about to take a consequential action, send the proposed action to BobSentry. BobSentry evaluates it against the policy and context you provide and returns ALLOW, REQUIRE_APPROVAL, or BLOCK. Your existing agent and executor remain responsible for execution.

AI Agent
Proposed Action
BobSentry
ALLOWREQUIRE_APPROVALBLOCK
Existing Executor

Illustrative examples

What a decision can look like

These examples show the shape of a decision. They are not customer results.

refund_customer

$25

ALLOW

Within refund policy.

deploy_production

payments-api

REQUIRE_APPROVAL

Production change requires human authorization.

export_customers

5,000 records

BLOCK

Destination is not permitted.

Demo

See runtime authorization in action

Watch AI agent authorization in practice: an agent requests a consequential action, BobSentry evaluates policy in real time, requires human approval for AI agents when needed, and creates signed decision evidence before execution can proceed.

BobSentry provides the authorization decision. The integration remains responsible for execution.

The same authorization pattern shown here protects BobSentry's own production deployment pipeline.

Real production workflow

BobSentry protects BobSentry

Our GitHub Actions → AWS production deployment workflow runs through BobSentry before infrastructure mutation. When deploy_production is requested, policy returns REQUIRE_APPROVAL. A human authorizes the action, GitHub Actions performs the deployment, and the execution outcome is recorded separately from the authorization decision.

  1. deploy_production
  2. REQUIRE_APPROVAL
  3. Human authorization
  4. GitHub Actions deploys to AWS
  5. Execution outcome recorded

BobSentry authorizes the action. GitHub Actions and AWS perform the deployment.

How it works

How BobSentry works

  1. 01

    The agent wants to do something

    Deploy code, issue a refund, change infrastructure, export data, or perform another consequential action.

  2. 02

    BobSentry checks the action

    Who is acting? What are they trying to do? Where? What policy or context applies?

  3. 03

    BobSentry decides

    ALLOW, REQUIRE_APPROVAL, or BLOCK.

  4. 04

    Your system stays in control

    BobSentry returns the authorization decision. Your existing integration remains responsible for execution.

  5. 05

    BobSentry records the decision

    Keep signed evidence of what was requested, what BobSentry decided, and human authorization where applicable.

Product

What you operate in BobSentry

See who asked, which actions may proceed, what BobSentry decided, and the signed record of that authorization decision.

Available

Agents

Know which agent requested the action.

Available

Policies

Define which actions may proceed.

Available

Runtime Decisions

See what BobSentry decided.

Available

Approvals

Review actions that need human authorization.

Available

Evidence

Keep signed records of authorization decisions.

Available

Policy Simulator

See what BobSentry would decide before using a policy in a real workflow.

Developer path: Developers. Full product overview: Product.

Trust boundary

Authorization boundary, not silent execution

Metadata-only by default: raw business payloads can remain in your environment while BobSentry receives the normalized action context needed for authorization. BobSentry returns a signed authorization result. Starter controls and unmatched-action fallbacks keep unknown actions from falling through to a silent ALLOW.

BobSentry returns the authorization decision; the integration must honor it. BobSentry does not execute the downstream action.

Customer environment

  • AI agent
  • Sensitive payload
  • Local classification / redaction

Normalized action metadata

BobSentry

  • Deterministic policy evaluation
  • Human authorization
  • Signed decision evidence

COOPERATIVE

The integration calls BobSentry before the consequential operation and is responsible for honoring the authorization decision.

OBSERVE

BobSentry evaluates and records what policy would decide, but does not control downstream execution.

Customer-facing modes today are COOPERATIVE and OBSERVE. There is no customer-selectable ENFORCED mode. Read the full security model on Security.

A common authorization boundary across different agents and executors.

Your agents may come from different vendors, frameworks, or internal teams. Their consequential actions can be evaluated through a common BobSentry authorization boundary while your existing integrations and executors remain responsible for performing or withholding the action.

  • Coding agent
  • Ops agent
  • Support agent
Existing integration / executor

performs or withholds

Consequential action

Examples

  • GitHub
  • AWS
  • Stripe
  • Internal API

asks for a decision

BobSentry

ALLOWREQUIRE_APPROVALBLOCK
Explanatory only. BobSentry returns ALLOW, REQUIRE_APPROVAL, or BLOCK. Your existing integration or executor remains responsible for performing or withholding the downstream action.

Working with teams operating consequential agents

One consequential action. One execution boundary. Start in OBSERVE. Your existing agent, approval flow, and executor can stay unchanged.

What actions does your team still refuse to let agents execute automatically?

  • Production changes
  • Financial operations
  • Customer communications
  • Access and permission changes
  • Sensitive exports
  • Destructive operations
  • AI agent platforms
  • AI automation companies
  • Enterprise AI teams
  • Healthcare AI startups
  • Finance AI systems
Become a design partnerSee how it works

Prefer email?

Share the consequential actions you need to authorize and your integration call site.

Email hello@bobsentry.com

By contacting us you agree we may use your message to respond. See our Privacy page.

Or email the founder.