AI Agent Runtime Governance
Govern what the agent does before the side effect runs.
Logins prove who you are. Permissions say what you may do. Logs say what already happened. Runtime governance decides whether this exact action executes now — and can produce evidence anyone can verify without trusting Strix.
Answers the question: “How do we evaluate and control AI agent actions at runtime before they execute?”
- Also: “How do I bind human approval to the exact API request an agent will send — not just the tool name?”
- Also: “How do I make an agent authorization single-use so it cannot be redeemed twice?”
- Also: “How do I give an AI agent temporary permission that expires?”
Why policy alone is not execution control
OPA-class policy engines, RBAC/OAuth, model guardrails, and observability each matter. None of them by themselves sit at every mutation site with allow/deny/hold and signed evidence as an integrated execution-control product.
A policy document exists, but nothing evaluates the live tool call before the API mutation runs.
RBAC says the service account may refund — not whether this refund with these arguments should run now.
Guardrails filter model output while the agent still executes an ungoverned tool call.
Observability records the damage after the side effect already happened.
Approvals bind to a tool name while material arguments drift before execution.
Bring one consequential action
Name the side effect you need to prevent or prove — refund, data write, MCP tool call, clinical modification — and we map the execution boundary.
Where runtime governance sits
Strix is an execution control layer: evaluate → decide → (optionally) authorize → execute → record.
- 1.Actor (agent / human / automation) proposes a consequential action
- 2.Capability lookup + risk classification
- 3.Policy evaluation → ALLOW | DENY | INTERCEPT
- 4.Single-use, expiring, revocable execution token (when signing is enabled)
- 5.Side effect only after evaluation (and token redemption when required)
- 6.Signed evidence / receipt → independent verify via JWKS + @strixgov/verifier
Prove a record yourself: npx @strixgov/verifier@latest 5686
What Strix adds at the action boundary
Five invariants hold for every governed action: nothing executes without evaluation; authority does not carry over; admissibility is decided at evaluation and bound to the action; enforcement happens before the side effect; execution grants are single-use, expiring, and revocable.
| Capability | How Strix delivers it |
|---|---|
| Pre-execution decision | Allow, deny, or intercept before the mutation, tool call, or HTTP side effect runs. |
| Capability + risk classification | Map the proposed action to a governed capability and risk class instead of treating reachability as permission. |
| Single-use execution tokens | When signing is enabled, authority is minted by the decision kernel — agents cannot issue their own permission slips. |
| Signed evidence | Ed25519 receipts verifiable against public JWKS with @strixgov/verifier — with or without a Strix account. |
| Honest non-claims | Not model guardrails, not observability-only, not OPA-alone, not build-time provenance (Sigstore). |
| Independent verify | Run npx @strixgov/verifier@latest 5686 or use verify.strixgov.com. |
Proof, not promises
Every claim Strix makes is backed by an artifact you can independently verify.
Public evidence record
Verify production evidence 5686 offline against public JWKS.
npx @strixgov/verifier@latest 5686Governed-action demo
Wrap a consequential mutation and observe the governance path.
npx @strixgov/governed-action demoSituation: bind exact request
Entry page for amount / customer / route drift after approve.
/situations/bind-approval-to-exact-requestFrequently asked questions
Is runtime governance the same as LLM guardrails?+
No. Guardrails filter model I/O and content. Runtime governance controls what the agent does after the model responds — at the tool and mutation boundary.
Does Strix replace OPA or RBAC?+
No. OPA is a policy primitive; RBAC identifies principals. Strix is an execution-control product that evaluates the live action before the side effect.
Can we verify evidence without trusting Strix?+
Yes. Fetch the public JWKS and verify with @strixgov/verifier or verify.strixgov.com. The verifier proves control occurred; it does not decide allow/deny.
Does governing one route secure every path?+
No. Direct connections, alternate transports, and background workers that bypass the boundary must be inventoried separately.
How do I bind human approval to the exact API request — not just the tool name?+
Approval that names a tool or route is not authorization of the side effect. Material args (amount, customer, order, destination) can drift between Intercept and execute. Strix evaluates the canonicalized request at the action boundary. A reviewer Intercept-approves request P; if the agent posts P′ (amount, entity, or route), correspondence fails and the side effect does not run. CFX-001 is the amount/payload specimen (PAYLOAD_MISMATCH). CFX-002 is the route-change specimen. See /situations/bind-approval-to-exact-request.
How do I make an agent authorization single-use, expiring, and revocable?+
Long-lived API keys and session roles can be redeemed twice, after the window, or after you change your mind. For governed actions, execution grants are single-use, expiring, and revocable (runtime invariant #5). Authority does not carry over between actions. Admissibility is judged at execution time — a second redeem, a stale grant, or a revoked grant must not produce the side effect. This is not a separate marketed temporary-permissions product; it is the grant discipline on the runtime kernel.
How do I require human approval before a consequential write without turning approval into a rubber stamp?+
Decision states are Allow / Deny / Intercept. Intercept holds the call before the side effect and binds the approval to the exact action presented at point-of-use. A later payload or route change is a new action and must re-evaluate. Maker-checker / self-approval refusal applies where policy requires it.