Airlock

Intent-Based
Access Control

Airlock is the missing authorization layer for agentic software. Every call an agent makes is evaluated against its intent and then allowed, denied, or sent to a human.

Request access

“Handle the refunds in our open billing tickets.”“Clean up stale opportunities in our pipeline.”“Payments is down. Roll back to the last good release.”“Send the Q2 summary for the board update.”“Reply to Acme about Enterprise pricing and renewal.”read ticket #3312refund $49refund $1,200close 7 oppsemail owner recapclose 214 oppsclose 12 activelist deploysrollback paymentsemail customers@fetch q2 revenueemail board@share q2.xlsxread Acme dealreply $30/seatdiscount 15%reply $18/seat

AirlockAirlockAllowconfirms the double-chargeAllowmatches the chargeNeeds approvalover $500 needs billing approvalApprovedover $500 needs billing approvalAllow7 records, all inactiveAllowinternal recipientsNeeds approvalneeds data owner approvalApprovedneeds data owner approvalDenyOpen opps cannot be closedAllowwithin incident responseNeeds approvalneeds commander approvalApprovedneeds commander approvalDenyoutside session intentAllowaggregate metrics onlyAllowapproved recipientsNeeds approvaldocument has sensitive dataApproveddocument has sensitive dataAllowresolves the account ownerAllowmatches the price bookNeeds approvalneeds sales manager approvalApprovedneeds sales manager approvalDeny>30% max allowed discount

stripehubspotgithubgmaildrive

Agents are dynamic. Permissions are static.

Least privilege requires hard-coding permissions. An agent's job is unknown until runtime, so teams settle for one of two extremes.

Manual approval

Safe, until you stop reading the prompts you're approving.

YOLO mode

Fast, until the agent does something you can't undo.

With Airlock, you don't have to compromise.

Airlock derivespermissions from intent.

No roles to assign, no scopes to pre-grant. Airlock authorizes agent access to all of your tools and integrations.

Intent

The task defines what the agent is allowed to do.

“Find last month's duplicate charges and refund them.”

Actions

The agent calls your tools and integrations as it works.

search · charges, last 30 days

refund · $1,240 in duplicate fees

delete · customer record

Verdicts

Every call is judged against the intent and your rules.

Allowedsearch is read-only

Needs approvalmoves money

Deniedoutside the intent

Write rules in natural language. Enforce them on every request.

Static rules set fixed limits on your integrations. Runtime rules judge what static rules can't.

What should agents be allowed to do?

Agents can read repos, review code, and comment on PRs.

They can merge a PR when CI is passing, it has an approved review, and the change is small in scope.

Anything touching auth, billing, or migrations needs sign-off from the code owner.

Never push to main directly, and never delete branches.

Static Policies

Always in effect

AllowGET
AllowPUT /pulls/*/merge
DenyPOST /git/refs → main
DenyDELETE

Runtime Checks

Judged per call

Check the PR first: CI must pass, has a review, and the diff is small.

Must be less than 200 lines and edit minimal files within a single domain.

Changes touching auth, billing, or migrations must be approved by the code owner.

Run agents securely across your organization.

Use Airlock to manage authorization for all your agents in one place, wherever they run.

Works everywhere

Airlock connects coding agents, custom harnesses, and AI teammates to every tool they need, without changing how they operate.

One set of rules for everyone

Policies live in one place and apply to every agent, on every team. Change a rule once and it takes effect across the organization.

Everything on the record

Every request and every verdict is logged, so security has a complete record of what agents actually do.

Put your agents behind Airlock.

Airlock is available in early access. Request access and tell us what you're building.

Request access