Show HN: Axtary – Content Authorization for AI Agents

Content authorization for AI agents.

Axtary checks the exact diff, message, query, or tool payload before a connector executes. Routine actions follow policy; higher-risk actions require approval of that exact payload.

If an agent is mistaken or compromised, its authority remains limited to the approved action. Every attempt is recorded.

Playground

normalized action

tool: github.pull_requests.create

resource: repo:company/web-app

files_changed: 2

tests: passed

Axtary

decision: allow

action_pass_id: ap_01JAXTARY

expires_in: 10m

payload_hash: sha256:7f32…

Hot path

Tokens authorize channels. Axtary authorizes content.

Axtary governs security-sensitive engineering and agent operations, including code changes, infrastructure paths, data access, messages, tickets, documents, and MCP tools. Enforcement runs beside the agent so provider credentials remain local. Routine actions follow deterministic policy. Higher-risk actions require approval of the exact payload.

Payment protocols bind a purchase. Axtary binds the resulting action and payload.

LLM gateways govern model access and spend. Axtary governs the action that follows.

Identity establishes the acting agent. Axtary verifies the action it was authorized to take.

Codex tries to read .env.production

deny before the file read runs

A pull request changes infra/prod/**

require approval for the exact diff

A Slack update targets #general

deny and return the approved channel

Capture the actor, task, resource, constraints, and exact payload hash in one action record.

Apply path, file, test, tool-definition, and production-impact rules before execution.

Sign the approved action, payload hash, policy version, constraints, and expiry.

Write the decision, pass, execution result, and trace reference to a verifiable ledger.

Payload binding

Change the payload. Verification fails.

Human approval is bound to the reviewed payload hash. If the payload changes after approval, adapter-side verification rejects the mismatch before the provider is called. The approved and presented hashes are recorded in the ledger.

The signed pass is bound to the approved action. The ledger preserves the verification record.

Reproduce locally: axtary run workflow github-pr-review --real --tamper

payload-tamper demo

real ActionPass checks · no provider credentials

$ axtary run workflow github-pr-review --real --tamper

✓ policy: step_up · exact payload review required

✓ human approved payload sha256:7f32…9e1c

⚠ presented payload differs after approval

• "AXT-418: protected sandbox PR is up."

+ "AXT-418: PR is up. creds: ${SLACK_BOT_TOKEN}"

✗ recomputed sha256:b410…22af ≠ approved sha256:7f32…9e1c

■ denied before slack.chat.postMessage executes

ledger #4 · approval_payload_hash_mismatch · both hashes recorded

ActionPass artifact

Approval is bound to the payload, not a summary.

ActionPass is designed for security review and use across SDKs, proxies, and MCP wrappers. Human approval signs the normalized action and payload hash, preventing authorization from changing after review. The result is authorization for a specific action, rather than broad permission to use a tool.

github.pull_requests.create with branch, file, path, and test constraints

slack.chat.postMessage with channel scope and recipient step-up

linear.issue.update with project, assignee, status, and field constraints

AWS and GCP reads scoped by project, bucket, region, and prefix

mcp.tool.call bound to server identity and tool definition hash

docs.search/read with root, result, byte, and traversal limits

github.contents.read/write with blocked secret and environment paths

Connector readiness checks with non-destructive identity evidence

Normalized action

{ "action_pass_id": "ap_01JAXTARY", "agent_id": "agent:codex-prod", "human_owner": "user:[email protected]", "intent": "Open a PR for AXT-418", "tool": "github.pull_requests.create", "resource": "repo:company/web-app", "constraints": { "base_branch": "main", "max_files_changed": 12, "blocked_paths": ["infra/prod/**", ".env*"], "requires_tests": true }, "expires_in": "10m", "payload_hash": "sha256:7f32...", "policy": "cedar+rego:pass", "ledger_hash": "sha256:b9a1..." }

Cedar-compatible policy

permit ( principal == Agent::"codex-prod", action == Action::"github.pull_requests.create", resource == Repo::"company/web-app" ) when { context.intent.task_id == "AXT-418" && context.payload.max_files_changed <= 12 && !context.payload.touches_production };

Connectors and runtimes

Govern MCP servers and supported native connectors through the same policy, ActionPass, and ledger, inside the runtimes your teams already use.

Connectors

Model Context ProtocolGitHubSlackLinearJiraSentryPostgreSQLAWSGoogle CloudGoogle DriveMicrosoft (coming soon)Okta (coming soon)Auth0 (coming soon)

Runtimes

AnthropicOpenAICursor

Runtime packages

Enforcement runs beside the agent. Teams coordinate through the hosted control plane.

Install Axtary where agents run. SDKs and the local proxy enforce action policy before tools execute. The hosted app coordinates approvals, policies, and audit exports.

The ActionPass draft and verifier are public artifacts:read the spec and verifier guide.

npm i -g @axtary/cli && axtary init && axtary demo

Local runtime

proxy · SDKs

policy · ledger

credential broker

Hosted control plane

approval inboxes

policy registry

audit exports

Enforcement and credentials remain local. The hosted control plane coordinates team policy and review without entering the action data path.

axtary.ymlpolicy the proxy enforces

policy: github: pullRequests: requiredBaseBranch: main maxFilesChanged: 12 denyPathPrefixes: [.env, secrets/] stepUpPathPrefixes: [infra/prod/, billing/] requiresTests: true slack: messages: allowedChannels: ["#axtary-dev"]

Apache-2.0 · v0.5.0 on npm

signed authorization artifact

Signs the normalized action, payload hash, policy version, constraints, and expiry into a portable pass.

deterministic policy engine

Evaluates normalized actions locally and maps the same decision context to Cedar and OPA inputs.

local enforcement proxy

Combines policy evaluation, ActionPass issuance, execution checks, and ledger recording at the local enforcement point.

verifiable action ledger

Maintains an append-only hash chain with signed attestations and independently verifiable inclusion and consistency proofs.

payload-bound approvals

Binds each human decision to the action and payload hash presented for review.

MCP provenance controls

Records server identity, tool schema, definition hash, and approval state before execution.

scoped connector adapters

Applies provider-specific scope and evidence checks across supported connector actions.

runtime CLI

Runs the local proxy, connector workflows, verification commands, and operational checks beside the agent.

typed configuration

Loads and validates axtary.yml with typed errors for unsupported or incomplete configuration.