Let AI agents act without letting them run wild.
Agent action governance for tools, approvals, credentials, and receipts. Passrail gives agents scoped permissions, deterministic instructions, and signed proof for every action they request.
Built for developers and teams testing agents that call tools.
Agents are starting to take real actions. Most teams still lack a control layer.
AI agents can call tools, send messages, create records, trigger workflows, and touch sensitive systems. Without a trust layer, teams are left guessing what was allowed, what was approved, what executed, and what happened after.
Passrail puts policy, approval, receipts, audit logs, encrypted secrets, and signed webhooks in the path between agents and real-world actions.
Keep agents moving without giving them unchecked power.
Every action gets a decision. Not every action needs a human.
Passrail does not put a human in front of every action. It puts policy in front of every action. Low-risk actions can run automatically, sensitive actions pause for approval, and dangerous actions are blocked. Every decision creates a receipt, so approval is the exception, not the workflow.
Allowed automatically
Safe, low-risk actions (read, search, draft) run without waiting on anyone.
Approval when it matters
Sensitive actions pause for a human to approve or deny. You decide which ones.
Denied automatically
Dangerous actions are blocked by policy before they ever run.
Whether allowed, approved, or denied, every decision is recorded as a signed receipt and audit event.
More than a guardrail or a tool-call firewall.
Jailbreaks can change what an agent attempts. Passrail controls what it can actually do.
Passrail is not just a prompt guardrail or tool-call firewall. It is the decision, approval, credential, and receipt layer for agents that touch real systems. It governs what each action is permitted to do, keeps tool credentials out of the agent’s hands, and records signed proof of every outcome.
Clear instructions for every agent action
Passrail tells agents when to proceed, pause, stop, retry, or fail closed, not a vague status code to guess at.
- execution_permittedthe only green light to act
- agent_instructiona plain-language directive to follow
{
"decision": "require_approval",
"status": "pending_approval",
"execution_permitted": false,
"action_executed": false,
"agent_instruction": "Pause. Do not execute this action until the approval request is approved.",
"receipt_id": "RCP-001010"
}Built for the moment agents start touching real systems
Agent request, policy decision, human approval, and a signed receipt, all in one place.
gmail.send_emailPolicy: external emailRequires ApprovalEmail to client@example.com about invoice #1042.
hash 422da074bea4d769…Agent identity
Register agents, rotate keys, and scope what each agent can request.
Policy decisions
Allow, deny, or require approval based on agent, action, and risk.
Human approvals
Pause risky actions until a human approves, denies, or lets them expire.
Signed receipts
Create tamper-evident proof of every agent request and decision.
Secret Vault
Store tool credentials encrypted so agents never hold the keys directly.
Signed webhooks
Notify systems when approvals, expirations, and receipts change state.
How it works
Agent requests an action
Your agent calls the Passrail API before touching any real tool.
Passrail checks policy
Rules evaluate the agent, action, and risk to allow, deny, or require approval.
Human approval when needed
Risky actions pause for a reviewer to approve or deny, or they expire.
Instructions + receipt
Passrail returns a deterministic instruction and records a signed receipt.
Building agents that call tools?
Passrail is opening private beta for developers and teams who want policy, approval, receipts, and auditability before agents touch real systems.