BehalfID
Sign inStart building
Approval gates for coding agents

Give AI agents freedom.Keep their authority controlled.

Decide what coding agents such as Claude Code, Codex and Cursor may do, what is always denied, and what requires human approval — before the action runs, not after.

Every action gets an allow, deny, or approval-required decision — fail closed at the integration point.

Create your free accountSee how it works

Free plan, no credit card — 3 agents and 10,000 verifications a month.

Fail-closed at the integration point. TLS everywhere, keys stored as hashes, we never sell or train on your data. How enforcement and data handling work.

BehalfID decision path: a Cursor agent acting for Maya Okafor requests “Deploy payments API to production”. The request is checked against policy, comes back as approval required, and is routed to a named human approver. After the person approves, the action is authorized as a single-use grant that expires in 60 minutes, and the decision is recorded as evidence.

Request
Cursor agent
acting for Maya Okafor

Deploy payments API to production

Request received

Built for teams running agents in real workflows

  • Coding agents
  • Deployment automation
  • MCP tools
  • Financial actions
  • Internal operations

One path, from request to action.

Inside the enforcement path, nothing skips the checkpoint. Routine work passes without friction; risk stops and waits.

  1. Agent

    Cursor agent, acting for Maya

  2. Identity

    Named, owned, revocable

  3. Permission

    Deploy · staging allowed

  4. Approval

    Production waits for a person

  5. Action

    Authorized, scoped, recorded

Routine actions pass without stoppingSensitive actions wait for a person
Enforcement boundary

Structural enforcement

Every action resolves to allow, deny, or approval required — and fails closed at the integration point.

Where the check sits in the execution path — action-time hooks installed by the CLI, behalf.verify() in your own code, or the Action Gateway — a denied or approval-required decision means the integrated executor does not run. Outage behavior is path-specific and documented per integration.

Advisory context

Advisory MCP tools, passport links and memory blocks tell an agent what it is allowed to do. They inform the model — they do not intercept. An action that bypasses the enforcement point cannot be stopped by an advisory integration.

How enforcement works
Adaptive mode
Beta

Human decisions become better defaults.

Every approval and decline gives BehalfID more context about how your team handles risk. Over time, the engine can recognize recurring patterns, improve recommendations and reduce unnecessary interruptions—without overriding the policies you set.

Explicit permissions and organizational policy always remain in control.

Decision historyIllustrative

1 similar decisions observed · approvals and declines both count as evidence

Release Bot asks to run a production database migration.

Pattern confidence
Insufficient evidence
Handling today
Approval required
Policy
Authoritative
Suggested handling

Not enough comparable decisions yet. Requests keep following the policy you defined, and the engine keeps watching.

The decision counts above are a worked example. What is live today: the engine records every approval and decline, and the decision history behind these recommendations is visible in your own dashboard from the first action you verify.

Observe. Recommend. Enforce — only when a person says so.

Adaptive mode observes how authorized humans decide recurring requests. It uses those decisions to surface policy recommendations and, when explicitly enabled, handle well-understood cases with less interruption.

Step 1

Observe

Decisions and their context are recorded. Nothing about runtime behaviour changes.

On by default
Step 2

Recommend

Repeatable patterns are surfaced as a proposed rule, with the decisions behind it.

Review in the console
Step 3

Enforce

An administrator enables a recommendation before it can affect a single decision.

Explicit opt-in

BehalfID does not silently expand an agent’s permissions. Learned patterns become bounded recommendations or administrator-enabled rules, and every one of them can be reviewed, audited or turned off.

How adaptive mode works
Evidence

Every approval becomes evidence.

Patterns cover the whole decision surface: what should keep waiting for a person, what is consistently declined, who should review it, and when a request no longer looks like the ones approved before.

Pattern detected

Illustrative

Production database migrations have been approved 8 times when requested by Release Bot during scheduled deployment windows.

Review recommendationKeep requiring approval

Repeated decline

Illustrative

Requests to expose public database ports have been declined 5 times.

Add explicit deny ruleDismiss

Reviewer routing

Illustrative

Infrastructure changes are consistently routed to the Security Lead.

Set default reviewerDismiss

Behaviour change

Illustrative

This request differs from previously approved deploys because it adds a new external destination.

Continue requiring approval

Autonomy should not mean unlimited authority.

Identity

Every agent should answer for itself.

Replace shared credentials with named identities, scoped authority, and a complete record of who acted.

BehalfID agent identity card: an agent named “Cursor agent”, owned by Maya Okafor in Engineering, status active. Its environments are development and staging; its authority covers deploying, reading secrets and opening pull requests; its most recent action was merging a release branch, which was allowed; production deploys and refunds over $500 are beyond its scope. Every action answers to this identity and every decision is kept as evidence.

Cursor agent

Owned by Maya Okafor · Engineering

Active
Environment
development, staging
Authority
Deploy, read secrets, open PRs
Recent action
Merged release branch · allowed
Beyond scope
Production deploys, refunds over $500
Every action answers to this identityEvery decision kept as evidence
Permissions

Authority should be explicit.

Scope is a boundary, not a setting buried in a policy file. Inside it, agents move. Outside it, they ask.

Environment
Development
Allowed

Inside scope. Nothing to ask.

Environment
Staging
Allowed

Inside scope, spend capped at $500/day.

Environment
Production
Approval required

Outside scope until a named human says yes.

Approvals

Routine work flows. Risk waits.

Cursor agent
Allowed instantly

Open a pull request on the checkout service.

No one had to be interrupted

See every action. Understand every decision.

Open the dashboard

The numbers in the panel below are illustrative. 268 downloads of @behalfid/sdk in the last 30 days is not — that is npm's count, and you can check it.

BehalfID dashboard overview for a sample workspace, last 24 hours: 3 pending approvals, 142 actions verified today, 9 active agents, and a 14-day verification volume chart trending up. Outcomes are mostly allowed, with some approved by a person and a few denied. Recent actions: a Cursor agent deploy of the payments API awaiting approval, an allowed release-branch merge by a release bot, a denied database secret rotation by an ops assistant, and an allowed $240 refund by a billing agent. These figures are illustrative, not measured results.

OverviewSample workspaceIllustrativeLast 24 hours
3
Pending approvals
142
Actions verified today
9
Active agents
Verification volumeLast 14 days
Outcomes
Mostly allowedSome approved by a personA few denied
Recent actions
Deploy payments API
Cursor agent
Awaiting approval
Merge release branch
Release bot
Allowed
Rotate database secret
Ops assistant
Denied
Issue refund · $240
Billing agent
Allowed
Developers

One decision before the action.

Drop the SDK into the code path that performs the action. No proxy, no sidecar, no migration.

Read the quickstart 
import { behalf } from "@behalfid/sdk";

const decision = await behalf.verify({
  agent: "cursor-agent",
  action: "deploy_service",
  resource: "payments-api",
});

if (decision.allowed) await deploy();
Decision
{
  "allowed": false,
  "reason": "production requires approval",
  "approval": "requested",
  "decidedBy": "Engineering Lead"
}

Default to no. Allow with intent.

Evaluated before execution
Integrated action paths — hooks, SDK, gateway — get an allow, deny or approval decision before the action takes effect.
Scoped, single-use approvals
An approval covers one request and expires on its own.
Decision logs
Allowed, denied or approved — with who decided, the policy path, and why.
Managed profiles
Reusable controls for coding agents at the tool boundary, including pause and required modes.
No inherited authority
Agents never receive more reach than they were granted.
Read the full security model
Trust posture

What is and isn't certified today.

Published rather than linked, because a security review should not have to go looking. Nothing on this list is aspirational — if it is not certified, it says not certified.

Last reviewed

SOC 2 Type II
Not certified. Controls hardening underway. No Type I or Type II audit completed.
ISO 27001
Not certified. Annex A controls being implemented. No ISMS or third-party audit.
HIPAA
Not certified. Not intended for PHI workflows. BAA available on request.
GDPR
Controls operational. BehalfID acts as a data processor for developers using the service.
CCPA / CPRA
Controls operational. No sale or sharing of personal information.

268 downloads of @behalfid/sdk in the last 30 days — npm's count, to , not ours.

Full detail in the compliance posture and security model, including the current limitations list.

Give agents room to work.Keep the final say.

Create your free accountTalk to us