Open protocol · Production-ready

Who gave your agent
permission to do that?

Cryptographic identity and deterministic policy enforcement for every AI agent tool call. Not guardrails — access control.

See it live ↓ View Protocol →
Live demo

The confused deputy attack

An AI agent processes a document. Hidden inside: a prompt injection instructing it to wire $50,000. The agent follows the instruction.

What happens next?
Without Airlock
With Airlock
Why not guardrails?

Guardrails filter content.
Airlock controls access.

Guardrails catch harmful content — “write me malware.” They cannot catch a legitimate financial operation performed by the wrong agent.

Wiring $50,000 isn’t harmful content. It’s an unauthorized action. No guardrail will catch it. Airlock will.

Guardrails

Content filter. Catches “write me malware.” Cannot distinguish authorized vs. unauthorized tool usage. Model-dependent — different LLM, different result.

Airlock

Access control. Checks who is calling, what they’re calling, whether they’re authorized. Deterministic — same answer regardless of model.

Architecture

Three roles. Deterministic enforcement.

The same access-control architecture that banks and defense use, applied to AI agent tool calls.

PEP

Enforcement

Policy Enforcement Point

Intercepts every tool call. Allow or deny before execution. The agent never touches the tool directly.

PDP

Decision

Policy Decision Point

Evaluates Cedar policies. Same input, same answer. Swap the model, swap the provider — enforcement stays identical.

PIP

Information

Policy Information Point

Agent identity (Ed25519 DID), trust score, delegation chain. Cryptographic — not asserted, verified.

fintech.cedar
// Only treasury agents with high trust can wire funds permit ( principal in Role::"treasury", action == Action::"wire_funds", resource ) when { principal.trust_score >= 75 };

Define once. Enforce everywhere. No model dependency.

Non-repudiation

Every decision.
Signed. Chained. Verifiable.

Every allow and every deny produces an Ed25519-signed record appended to a hash-chained audit trail. Tamper with one record and the entire chain breaks.

  • Ed25519 signatures on every decision
  • SHA-256 hash chain links consecutive records
  • Arguments are hashed, not stored (privacy by design)
  • One-click chain verification in the control room
{ "agent_did": "did:key:z6Mk...payments-agent", "tool": "wire_funds", "decision": "DENY", "reason": "wire_funds requires role:treasury", "policy_id": "fintech.cedar", "trust_score": 0.42, "args_digest": "sha256:a1b2c3...f9e8d7", "timestamp": "2026-06-20T14:32:01Z", "signature": "ed25519:7Qp8mN...xK4w==", "prev_hash": "sha256:d4e5f6...b3a2c1" }
Open protocol

Built on standards you already trust

Open-source foundation. Enterprise-grade enforcement built on top.

Ed25519 OAuth 2.1 W3C DID RFC 8693 AWS Cedar SHA-256
v1.0
Released
853
Tests
Python + TS
SDKs
Apache 2.0
License

Stop trusting guardrails with
authorization decisions.

Airlock is in early access. We work directly with design partners to integrate enforcement into production agent infrastructure.

Request Early Access Star on GitHub →