Gate what agents can do.

Set what an AI agent may access, spend, or change. The policy is checked before the action runs, and a blocked action always wins.

Connect an agent Read the agent docs

Definition

Agent access control means the permission check happens before the tool call, not in the logs after it.

Identity, policy, decision, receipt

1
Identity
The request names which agent is acting and who it acts for.
2
Policy
The delegation sets the allowed actions, the spend cap, and the end date.
3
Decision
The gate checks the policy before the tool, payment, file, or sensitive action runs.
4
Receipt
A checked action leaves a proof with the agent, its owner, and the result.

Require a permission before the action

gate.ts
import { ProofableClient, defineGate } from '@proofable/sdk';

const proofable = new ProofableClient();

const gate = defineGate([{ verifierId: 'agent-delegation' }]);

const result = await proofable.gateCheck({
  gate,
  subject: { agentId: agent.id },
});

if (!result.satisfied) {
  // The call never reaches the tool. Fail closed.
  throw new Error("Agent lacks permission");
}

When to use it

Use it when

An agent touches real tools, data, customers, or money.
You need a spend cap, an end date, or per-action limits.
Auditors or buyers ask who authorized the action.

Not when

A sandboxed agent with no side effects.
Access you already enforce with a sign-in tool and nothing more.

How enforcement behaves

Deny wins over allow. A blocked action never runs.
A missing or expired permission fails closed.
An irreversible action can require a person to approve it first.
Access can be revoked at any time.

Set the limits before it acts.

Give the agent its identity, its permissions, and a spend cap. The check runs before every action.

Connect an agent

Gate what agents can do.

Set what an AI agent may access, spend, or change. The policy is checked before the action runs, and a blocked action always wins.

Connect an agent Read the agent docs

Definition

Agent access control means the permission check happens before the tool call, not in the logs after it.

Identity, policy, decision, receipt

1
Identity
The request names which agent is acting and who it acts for.
2
Policy
The delegation sets the allowed actions, the spend cap, and the end date.
3
Decision
The gate checks the policy before the tool, payment, file, or sensitive action runs.
4
Receipt
A checked action leaves a proof with the agent, its owner, and the result.

Require a permission before the action

gate.ts
import { ProofableClient, defineGate } from '@proofable/sdk';

const proofable = new ProofableClient();

const gate = defineGate([{ verifierId: 'agent-delegation' }]);

const result = await proofable.gateCheck({
  gate,
  subject: { agentId: agent.id },
});

if (!result.satisfied) {
  // The call never reaches the tool. Fail closed.
  throw new Error("Agent lacks permission");
}

When to use it

Use it when

An agent touches real tools, data, customers, or money.
You need a spend cap, an end date, or per-action limits.
Auditors or buyers ask who authorized the action.

Not when

A sandboxed agent with no side effects.
Access you already enforce with a sign-in tool and nothing more.

How enforcement behaves

Deny wins over allow. A blocked action never runs.
A missing or expired permission fails closed.
An irreversible action can require a person to approve it first.
Access can be revoked at any time.

Set the limits before it acts.

Give the agent its identity, its permissions, and a spend cap. The check runs before every action.

Connect an agent

Gate what agents can do.

Identity, policy, decision, receipt

Identity

Policy

Decision

Receipt

Require a permission before the action

When to use it

Use it when

Not when

How enforcement behaves

Set the limits before it acts.

Gate what agents can do.

Identity, policy, decision, receipt

Identity

Policy

Decision

Receipt

Require a permission before the action

When to use it

Use it when

Not when

How enforcement behaves

Set the limits before it acts.