Your AI Agent Shouldn't Sign Its Own Permission Slips

What it does

Agent-Safe Pipeline is a TypeScript reference architecture that sits between an AI agent and the APIs it wants to touch. The agent proposes an action, but it never decides if the action is allowed, never sees downstream credentials, and never picks the handler that runs. Instead, the proposal is captured as an immutable canonical intent, hashed, and sent to an independent Decionis policy service which returns ALLOW, ESCALATE, or BLOCK. Only a SafeExecutor with a matching single-use grant can run the approved handler.

The interesting bit

The project treats serialization drift as a security bug. It ships conformance vectors for canonical intent hashing that cover Unicode astral planes, negative zero, and NFC versus NFD normalization, because a mismatched hash is a potential authorization bypass. It also runs mutation testing against its trust-boundary tests to ensure the safety logic actually fails closed when code changes.

Key highlights

• Agents propose; Decionis decides. The architecture enforces that agents cannot possess privileged credentials or select their own execution handlers.
• Grants are single-use, intent-bound, and consumed atomically before the trusted handler runs; mismatches or network errors fail closed to BLOCK.
• Escalated intents route through Presence for verified human approval before Decionis re-evaluates policy.
• Runnable examples cover Shopify refunds, GitHub deployments, procurement budgets, and MCP tool gating.
• Extensive security artifacts: threat model, architecture docs, deterministic fuzz tests, and coverage thresholds of 90% for lines/functions/statements.

Caveats

• This is a library and reference implementation, not a hosted authorization service. Production use requires your own server-side credentials and infrastructure for Decionis and Presence.
• The safety claims depend entirely on preserving the documented trust boundary; it is explicitly not a substitute for provider-side identity, least privilege, network isolation, or incident response.

Verdict

Worth studying if you are building agentic systems that need auditable proof the agent cannot unilaterally act. Skip it if you are looking for a drop-in SaaS authorization provider or a lightweight permission wrapper.