Axtary

About Axtary

Axtary is content authorization for AI agents: it checks the exact diff, message, query, or tool payload before a connector executes, rather than granting an agent blanket permission to use a tool. Routine actions follow policy and pass automatically; higher-risk actions require human approval of that specific payload. The mechanism is payload binding. When a human approves an action, the approval is cryptographically bound to a hash of the normalized payload — not to a summary of it, and not to a classification of the message. If anything in the payload changes after approval, adapter-side verification recomputes the hash, sees the mismatch, and rejects the call before the provider is ever contacted. Their own demo runs this deliberately: same actor, same task, same tool, same target, but the Slack message body swapped from a benign PR notice to one exfiltrating staging credentials — the recomputed hash no longer matches the approved one, and the call is denied before slack.chat.postMessage executes, with both hashes recorded in the ledger. The practical consequence is that if an agent is mistaken or compromised, its authority is limited to the exact action a human actually reviewed. Every attempt, approved or denied, is recorded. The ActionPass artifact works across SDKs, proxies, and MCP wrappers, with constraint examples covering GitHub pull requests scoped by branch, file, path and tests, Slack messages scoped by channel and recipient, Linear issue updates scoped by project and field, AWS and GCP reads scoped by project, bucket, region, and prefix, and MCP tool calls bound to a server identity. Everything is reproducible locally with a tamper flag.

Key Features

Axtary Pros & Cons

Who Is Axtary Best For?

Tags