Skip to content
PERMISSION/PROTOCOL
The AI authorization layer for agents

Your agents take action. You decide what’s allowed.

Set the rules. Require approval when it matters. Get proof of what was authorized.

For MCP tool calls and GitHub deployments.

Explore integrations
179 documented incidents of agents acting without authorization, 30 of them critical

An agent asks. A human decides.Watch the hold, the approval, and the receipt.

Want to make the decision yourself?Try the interactive demo

Where PP fits

One place to authorize agent actions.

A shared authorization layer across the workflows you connect.

Before

Separate paths. Scattered controls.

Each connection has its own permissions and approval logic.

Agent 1Agent 2Agent 3MCP toolsGitHubAgent 1Agent 2Agent 3MCP toolsGitHub

With Permission Protocol

Clear rules. Accountable actions.

Check policy, get approval when required, and keep proof.

Agent 1Agent 2Agent 3MCP toolsGitHubPERMISSION PROTOCOLPolicyApprovalwhen requiredAuthorization receiptAgent 1Agent 2Agent 3MCP toolsGitHubPERMISSION PROTOCOLPolicyApprovalwhen requiredAuthorization receipt

Illustrative architecture for configured MCP tool calls and GitHub deployment gates. Agents must use the enforced path for authorization to apply.

Works with

Where the gate sits, and what it holds.

Marks belong to their owners. A mark here means the gate applies to that platform, not endorsement.

Gates

Where the action waits. A GitHub required check holds the merge; MCP Guard holds the tool call in the proxy.

  • GitHub
  • MCP
How a gate works

Agents

Any agent that opens a pull request, or calls a tool through MCP Guard.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Gemini CLI
  • Windsurf
  • Cline
  • OpenAI Codex
Coding agents

Deploys that wait

Production deploys wait when the host deploys from a gated branch, or when the gated workflow runs the deploy.

  • Vercel
  • Netlify
  • Render
  • Railway
  • Fly.io
Gate the deploy itself

A protected GitHub change

Follow one action from request to receipt.

An agent proposes a change to a production path your team has chosen to protect.

  1. 01

    The agent requests a change

    The connected workflow checks the proposed commit against your configured policy.

    Request
  2. 02

    Your rules determine approval

    For a change that requires signoff, a named approver reviews the exact action before the protected workflow can proceed.

    Approval required
  3. 03

    Keep the authorization record

    A signed receipt binds the authorization to the approved change, ready for later review and verification.

    Authorization recorded

Example flow for a configured approval gate. Required checks and deployment rules enforce the protected path.

The evidence

Proof of what was authorized.

A receipt connects the approved action to the agent, the signer, and the policy that applied.

  • The exact action or commit covered by the approval.
  • The named signer and the authorization time.
  • A signature you can independently verify.
See a real signed receipt

✓ ACTION AUTHORIZED

github-actions → production

Deploy gate authorization approved

Agent
github-actions
Signer of record
rodchalski
Policy
deploy-gate-v1
Timestamp
2026-08-21T22:26:38.587Z
SignatureVerified ✓

Ed25519 signature verified at build time over the canonical payload digest against the issuer public key published at /api/v1/keys/current

Issuerpermissionprotocol.com
Technical Details

Key ID

pp_key_348f56d61d0deab4

Key fingerprint

SHA256:Is7fInHqiSzzPaHqEJeJUMG/L7MEMs0zYT3R8g95z3s

Payload digest (sha256)

aa4729afd171817a690ab21ae46e16888a854a20c4096f778bc1e6ccbdaccc69

Signed payload bytes (base64)

eyJhZ2VudElkIjoiZ2l0aHViLWFjdGlvbnMiLCJhdHRyaWJ1dGlvbkNvbmZpZGVuY2UiOiJjcmVkZW50aWFsZWQiLCJjYW5vbmljYWxpemF0aW9uIjoiamNzX3YyIiwiY29tcGFueUlkIjoiY21sazMxbGw4MDAwMXppbGJqcGpyOGt5bCIsImNyZWF0ZWRBdCI6IjIwMjYtMDgtMjFUMjI6MjY6MzguNTg3WiIsImRlY2lkZXJBdXRoTWV0aG9kIjoic2Vzc2lvbiIsImRlY2lkZXJEaXNwbGF5Ijoicm9kY2hhbHNraSIsImRlY2lkZXJJZCI6InVzZXI6Y21rcmM2ZmliMDAwMDkwY2p3dnZyc3RscSIsImV4cGlyZXNBdCI6IjIwMjYtMDgtMjFUMjI6NDE6MzguNTY1WiIsImlkIjoicmNwdF9kZ19jbXQzZ2tpZWcwMDAzdjVjd29ubmE4cGs1IiwiaWRlbUtleSI6ImRlcGxveS1nYXRlOmNtdDNna2llZzAwMDN2NWN3b25uYThwazU6NmUyNzg0NmZlM2YyMjRjOWZjYTdiNWQ3ODNhYWM1MTllYjM1ZWEzOTJlMTJhNzI3MTEzNzQ3NzJmZWRhYzBjNiIsImlucHV0SGFzaCI6IjZlMjc4NDZmZTNmMjI0YzlmY2E3YjVkNzgzYWFjNTE5ZWIzNWVhMzkyZTEyYTcyNzExMzc0NzcyZmVkYWMwYzYiLCJwb2xpY3lWZXJzaW9uIjoiZGVwbG95LWdhdGUtdjEiLCJyZWFzb25Db2RlcyI6IltcIkRFUExPWV9HQVRFX0FQUFJPVkVEXCJdIiwicmVjZWlwdFZlcnNpb24iOjIsInJlcXVlc3RKc29uIjoie1wiYWN0aW9uXCI6e1wib3BlcmF0aW9uXCI6XCJkZXBsb3lcIixcInRvb2xcIjpcImdpdGh1Yi1hY3Rpb25zXCJ9LFwiY29udGV4dFwiOntcImVudmlyb25tZW50XCI6XCJwcm9kdWN0aW9uXCIsXCJyZXZlcnNpYmlsaXR5XCI6XCJSRVZFUlNJQkxFXCJ9LFwiZW5yaWNobWVudFNuYXBzaG90XCI6e1wiY29uZmlkZW5jZVdhcm5pbmdzXCI6W1wiTGFyZ2UgY2hhbmdlc2V0IOKAlCBzdW1tYXJ5IG1heSBub3QgY2FwdHVyZSBhbGwgY2hhbmdlc1wiXSxcImdlbmVyYXRlZEF0XCI6XCIyMDI2LTA4LTIxVDIxOjI1OjUxLjUzMlpcIixcImxpbmtlZElzc3VlVGl0bGVcIjpudWxsLFwicmlza1NpZ25hbHNcIjpbXSxcInN1bW1hcnlcIjpcIlRoaXMgcHVsbCByZXF1ZXN0IGNoYW5nZXMgcHJvZHVjdCBvciBkZXBsb3kgYmVoYXZpb3IgaW4gdGhlIGFyZWFzIGRlc2NyaWJlZCBieSB0aGUgZW5naW5lZXJpbmcgdGVhbS4gUmV2aWV3ZXJzIG1heSBzZWUgYSBkaWZmZXJlbnQgcmVzdWx0IGluIHRoZSBhZmZlY3RlZCB3b3JrZmxvdyBhZnRlciB0aGlzIGlzIHJlbGVhc2VkLiBPcGVyYXRvcnMgbWF5IG5lZWQgdG8gd2F0Y2ggdGhlIGFmZmVjdGVkIGZsb3cgY2xvc2VseSBvbiB0aGUgZmlyc3QgZGVwbG95LlwiLFwidmVyaWZpY2F0aW9uU3RlcHNcIjpbXX0sXCJpbnRlbnRcIjp7XCJjYXRlZ29yeVwiOlwiZGVwbG95bWVudFwiLFwibmFtZVwiOlwiZGVwbG95X2dhdGVfYXBwcm92YWxcIixcInN1bW1hcnlcIjpcIkRlcGxveSBnYXRlIGF1dGhvcml6YXRpb24gYXBwcm92ZWRcIn0sXCJtZXRhZGF0YVwiOntcImRlcGxveUdhdGVSZXF1ZXN0SWRcIjpcImNtdDNna2llZzAwMDN2NWN3b25uYThwazVcIn0sXCJwb2xpY3lcIjp7XCJleHBpcmVzQXRcIjpcIjIwMjYtMDgtMjFUMjI6NDE6MzguNTY1WlwifSxcInNjb3BlXCI6e1wiYXJ0aWZhY3RfZGlnZXN0XCI6bnVsbCxcImNhcGFiaWxpdHlcIjpcImRlcGxveTpwcm9kdWN0aW9uXCIsXCJjb21taXRTaGFcIjpcImEyZGYyNTlkMmM4NjUxYjI2ZDk5MWJiMzlmNzUwZjhiMjVlOGZkNjBcIixcImVudlwiOlwicHJvZHVjdGlvblwiLFwicmVmXCI6XCJyZWZzL3B1bGwvNTE5L2hlYWRcIixcInJlcG9cIjpcInBlcm1pc3Npb24tcHJvdG9jb2wvc2l0ZVwiLFwid29ya2Zsb3dcIjpudWxsfX0iLCJyZXNvbHV0aW9uVHlwZSI6ImFsbG93X29uY2UiLCJzY29wZSI6InByb2R1Y3Rpb24iLCJzaWduYXR1cmVBbGciOiJlZDI1NTE5Iiwic2lnbmF0dXJlS2V5SWQiOiJwcF9rZXlfMzQ4ZjU2ZDYxZDBkZWFiNCIsInN0YXR1cyI6IkFQUFJPVkVEIiwic3VtbWFyeSI6IkRlcGxveSBnYXRlIGF1dGhvcml6YXRpb24gYXBwcm92ZWQifQ==

Signature (base64)

h3v1UqFVSeS68d3uPTTQj0LQxs4Olqr4Mnn0wesA0kRiSekHSEKVM0rx5U8xLdq9IP8n4nh7xUva7bdUWNwzDg==

Verify it yourself

curl -so payload.bin https://permissionprotocol.com/homepage-receipt/payload
curl -so payload.sig https://permissionprotocol.com/homepage-receipt/signature
curl -so issuer.pem https://permissionprotocol.com/homepage-receipt/issuer-key
openssl pkeyutl -verify -rawin -pubin -inkey issuer.pem -in payload.bin -sigfile payload.sig

The shared receipt page shows a redacted view; the full verifiable artifact is above.

app.permissionprotocol.com/r/rcpt_dg_cmt3gkieg0003v5cwonna8pk5

How to read the receipt and its signature

Two ways to start

Start with the workflow you need to control.

AI agent authorization connects your rules to the action an agent is about to take. Choose a tool-call or GitHub approval workflow, then test the policy and human decision before expanding its scope.

MCP tool authorization

MCP Guard

Apply allow, block, and approval rules to tool calls routed through the open-source MCP proxy. Use observe mode to review decisions before turning enforcement on.

Explore MCP Guard

GitHub deployment approval

Deploy Gate

Add an approval and receipt check to a GitHub workflow. Configure required checks and deployment rules for the changes your team chooses to protect.

Explore Deploy Gate

For engineering and review teams

Keep your approvals. Make them evidence.

When someone asks who authorized a change, hand them a record tied to that action. Keep your existing review process and use the receipt as supporting evidence. Your reviewers determine whether it meets their requirements.

Explore compliance mappings Why authorization evidence matters

A clear first step

Start free, or put one gate live in 30 days.

For developers

$0 Free plan

Try the GitHub approval and receipt flow yourself. MCP Guard is also available as open source.

  • 1 named signer
  • 1 connected repository
Start free

For teams with a security review coming

$10,000 Design Partner Pilot

Thirty days, one gate, live in production. Built with the engineers who made Permission Protocol, with a security review pack at the end.

  • One gate: money out, agent code to prod, infra changes, PII or PHI export, or identity changes
  • One repository or MCP client, in your environment
  • Named signers and acceptance criteria agreed on day one

Three seats open. Credited in full to Annual. Full refund if the acceptance criteria are missed.

See pilot details

A few things to know

Before you connect a workflow.

What is AI agent authorization?

AI agent authorization determines whether an agent may perform a specific action under your rules. Permission Protocol applies policy checks and human approval to configured MCP tool calls and GitHub workflows. Authorization records document the decision; their format and signing requirements depend on the integration.

What gets blocked?

The paths you configure for enforcement. A GitHub approval gate can require a matching receipt for a protected change. MCP Guard evaluates tool calls against your rules: allow, block, or require approval. Observe mode logs decisions without blocking calls.

Can we keep our existing approvals?

Yes. Keep your code review and branch protection. Configure Permission Protocol alongside them to add an authorization record tied to the approved action. During setup, agree which approval workflow and evidence fields your team needs.

Can an agent bypass the gate?

The gate controls only the paths routed through it. An agent with direct credentials or another execution path may bypass it, and an administrator may remove a required check. Setup must address those alternate paths and who can change the controls.

What happens during an outage?

Behavior depends on the integration and its configuration. Some Deploy Gate versions allow a workflow to continue on API errors; do not assume every integration fails closed. Local MCP Guard enforcement runs in your environment. Test unavailable-service behavior before relying on a gate for production.

What does setup involve?

Choose one workflow, define the actions that need approval, and configure the integration and approvers. Test approval, denial, changed actions, alternate execution paths, and outages. Start with the product setup guide, or use the Design Partner Pilot for hands-on setup with our engineers and agreed acceptance tests.

Choose the first action you want to control.

Bring one action, its approval path, and the evidence you need. Review the fit with an engineer who built it and agree a concrete next step.

Book a workflow review Prefer to write? Send your workflow
AI Authorization Layer for Agents | Permission Protocol