Axtary

Axtary is a content authorization layer that sits between AI agents and the actions they want to take. It validates exact payloads, diffs, messages, and tool calls against defined policies before anything actually runs. The goal is to give teams control over what autonomous agents can do without blocking the automation entirely.

The core idea is payload binding. When a human approves an action, that approval gets tied to a specific payload hash. If the payload changes after approval, the system rejects it before the provider is ever called. This means you're not approving a vague summary of what the agent wants to do, you're approving the exact action it will take, down to the line of code or the message content.

Axtary issues what it calls an ActionPass, a signed authorization artifact that represents approval for a specific action rather than broad tool permissions. An ActionPass can include constraints like file limits, blocked paths, required test passes, and expiration times. The policy engine supports Cedar and OPA-compatible policies, so you can write rules like agents can only create PRs to certain branches with a maximum number of files changed and certain directories off limits.

Everything gets logged to an immutable ledger. Every approval attempt, every mismatch, every execution gets recorded with hashes so you have a complete audit trail. If something goes wrong, you can trace exactly what was approved, by whom, and whether the actual execution matched the approval.

The platform ships with connectors for GitHub, GitLab, Linear, Jira, Slack, Sentry, AWS, Google Cloud, Google Drive, and PostgreSQL, with more coming. It also supports Model Context Protocol for broader AI platform integration. Runtime integration happens through modular npm packages for the CLI, proxy, policy engine, ledger, and ActionPass system.

Axtary targets teams that are deploying AI agents for real work but need guardrails that go beyond yes-or-no tool access. If you're using agents to create PRs, post to Slack, update issues, or query databases, this gives you the layer to enforce exactly what they can and cannot do. The product is Apache 2.0 licensed, currently at version 0.5.0, and operates on a request-access model during this early stage.