Axtary

Most authorization layers tell an agent what tools it can use. They say nothing about what it is allowed to do with those tools on a specific payload at a specific moment. Axtary intercepts the tool call, normalizes the action record — actor, task, resource, constraints, and payload hash — evaluates it against policy rules, and either passes it, blocks it, or routes it to a human for review of that exact payload. The signed ActionPass artifact expires and is bound to the reviewed hash; the connector adapter verifies the hash again before calling the provider. If the payload has been altered between approval and execution, the call is denied and both hashes are recorded in the ledger.

The payload-binding mechanism is the differentiating feature. Approval is not a broad permission to invoke a tool — it is authorization for a specific action with specific content. The vendor’s demo illustrates this with a tampered Slack message that injected a credential token after human sign-off; the adapter caught the hash mismatch and blocked the post before the Slack API was called. This closes the class of attack where an agent or compromised intermediary re-writes a payload after a human has already reviewed a summary rather than the literal content.

Axtary fits teams running pilots of agent workflows against security-sensitive targets: production repositories, infrastructure paths, internal Slack channels, cloud storage with sensitive prefixes. The ledger provides evidence for post-incident review and compliance documentation in non-production contexts. Where it does not fit: teams that need the tool to plan or orchestrate work — Axtary enforces policy on actions agents propose, it does not generate or sequence those actions. Teams whose connectors fall outside the documented set (GitHub, Slack, Linear, AWS/GCP reads, MCP tool calls, document search) will need to build adapter-side verification themselves before the hash-binding guarantee applies.

The self-hosted deployment runs policy evaluation locally so provider credentials never leave the host environment. The vendor describes a CLI-first workflow — `axtary run workflow` — used for reproducing and testing policy scenarios. ActionPass artifacts are designed to be consumed across SDKs, proxies, and MCP wrappers, so teams already using MCP-compatible tooling can slot verification in without replacing the agent runtime.