Gate what agents can do.

Set what an AI agent may access, spend, or change. The policy is checked before the action runs, and a blocked action always wins.

Connect an agent Read the agent docs

Agent access control means the permission check happens before the tool call, not in the logs after it.

Every call is checked before it runs.

The agent’s allowed actions, blocked actions, and spend cap decide each request. A blocked action never reaches the tool.

OperatorActs for atlas. Spend cap $25.00.

Read the #support thread.Read contextAllowed
Use the saved Stripe key.Use saved secretsAllowed
Refund order 4821 for $18.Run jobsAllowed
Run a script on the server.Run commandsBlocked
Pay $240 for a data report.Over the $25.00 spend capBlocked

Require a permission before the action

One call in front of the tool decides whether the agent may act. The decision comes back typed, and a denial never reaches the tool.

Checked before the tool runs: The check sits on your server, in front of the tool, payment, or file action.
Deny wins, every time: A blocked, missing, or expired permission fails closed. No prompt talks past it.
Spend caps and end dates: Cap what the agent may spend and decide when its access ends.
Keys stay in the vault: The agent uses saved secrets without ever reading them.
A proof for every checked action: Another app can check the same proof later. Built on Portable Proof.

Install Proofable Read the guarded action

OperatorActs for atlas. Spend cap $25.00.Verified

import { ProofableClient, defineGate } from '@proofable/sdk';

const proofable = new ProofableClient();

const gate = defineGate([{ verifierId: 'agent-delegation' }]);

const result = await proofable.gateCheck({
  gate,
  subject: { agentId: agent.id },
});

if (!result.satisfied) {
  // The call never reaches the tool. Fail closed.
  throw new Error("Agent lacks permission");
}

{
  "decision": "denied",
  "allowed": false,
  "action": "run_command",
  "code": "ACTION_DENIED"
}

Put a check in front of every call.

Give the agent its identity, its permissions, and a spend cap. The check runs before every action.

Connect an agent

Require a permission before the action

One call in front of the tool decides whether the agent may act. The decision comes back typed, and a denial never reaches the tool.

Checked before the tool runs

The check sits on your server, in front of the tool, payment, or file action.

Deny wins, every time

A blocked, missing, or expired permission fails closed. No prompt talks past it.

Spend caps and end dates

Cap what the agent may spend and decide when its access ends.

Keys stay in the vault

The agent uses saved secrets without ever reading them.

A proof for every checked action

Another app can check the same proof later. Built on Portable Proof.

import { ProofableClient, defineGate } from '@proofable/sdk';

const proofable = new ProofableClient();

const gate = defineGate([{ verifierId: 'agent-delegation' }]);

const result = await proofable.gateCheck({

  gate,

  subject: { agentId: agent.id },

});

if (!result.satisfied) {

  // The call never reaches the tool. Fail closed.

  throw new Error("Agent lacks permission");

}