AI Permission Check
Paste an MCP tool list. See which tools could move money, delete data or run code, and what to ask before an agent uses them. Nothing is uploaded.
AI agents
Your agents are ready to act. You’re still working out what they may do.
More agents can mean more decisions landing back on your desk. AtlaSent applies your company’s configured rules and authority to the exact consequential action, returning whether it may proceed, must wait or must stop. Start with a fictional refund decision, then explore the integration path for your own agents.
- Agent proposesAn exact tool call: target, arguments, effect.
- Who is actingThe agent’s own identity, and the person it acts for.
- Organizational authorityYour rules: who may do this, who must approve, what stays separate.
- RefuseNothing runs. The reason is recorded.
- HoldWaits for the person with authority to approve that exact call.
- AllowA single-use permit for exactly that call.
- Verify where it runsMCP host, sandbox or service checks the permit first.
- EffectOnly that action runs, once.
- EvidenceDecision, verification, execution and effect, recorded separately.
Changed arguments need a new decision.
Free · no login · runs in your browser
Try it on your own work first.
The gap
Every check can pass and the action can still be unauthorized.
Identity says who
The agent authenticated. That tells you who or what is acting, not whether your organization agreed to this action.
Sandboxes and tools say what is reachable
A sandbox policy or a connected MCP server decides what the agent can reach. Reachable is not the same as authorized.
Authority says whether
AtlaSent decides whether this exact action, on this target, by this agent acting for this person, is authorized now. Refused or unanswered means it does not run.
When agents change course
A blocked request does not authorize a detour.
A permitted information lookup can be refused by its destination. Trying another tool, an already-exposed credential or a different endpoint is a new proposed action, not a continuation of the original authorization.
On a configured AtlaSent execution path, a changed tool, target or material argument must pass a fresh decision and verified permit before the native effect. An independent browser, shell, MCP server or outbound network path is not covered unless the execution environment separately constrains it.
This is a control-design example, not a claim that AtlaSent prevented the reported incident. AI Permission Check is advisory; local MCP Gate allows only the operator's configured rules and does not issue organizational permits.
Test this boundary
- Let a permitted synthetic lookup return a provider refusal.
- Change the destination or tool: require a new decision.
- Try an unapproved credential or remote execution tool: block at the protected effect.
- Try a separate route: verify the sandbox, network or native execution control closes it too.
A prompt telling the agent to stop is useful guidance, not the enforcement point.
Where it plugs in
At the point the agent’s action executes.
MCP hosts
Claude Code, Cursor and other MCP hosts get AtlaSent tools with npx -y @atlasent/mcp-server. With no key it runs a local demo that protects nothing; a free API key adds advisory hosted decisions and receipts. Signed, single-use permits come with an activated action on Team Cloud or the design partner program. MCP Gate puts a fail-closed check in front of another server’s tools, locally and for free.
OpenShell sandboxes (experimental)
For agents running in NVIDIA OpenShell sandboxes, atlasent-openshell run evaluates the action, waits on a hold, verifies the permit and only then runs the command, once. OpenShell decides what the sandbox may reach; AtlaSent decides whether this exact action is authorized. A sandbox policy approval is never accepted as an AtlaSent approval. The adapter is experimental and qualified on specific OpenShell versions only.
Your own agent code
The TypeScript and Python SDKs put protect() in front of the tool effect. Without a verified permit the effect never runs, and a refusal throws with the reason.
AtlaSent is not affiliated with, endorsed by or a partner of NVIDIA. NVIDIA and OpenShell are trademarks of their respective owners and are named here only to describe compatibility.
How AtlaSent is different
Exact action. Any system. Outcomes you can check.
| Agent sandboxes and runtimes | Workflow and ticket approvals | AtlaSent | |
|---|---|---|---|
| The question it answers | What may this sandbox or process reach? | Was this request approved in the workflow? | Is this exact action authorized by the organization, now? |
| What a decision is bound to | Network, file and process policy for the environment | A ticket or request record | The exact action: target, revision, amount or arguments. Change it and it needs a new decision. |
| Where it applies | Inside that runtime | Inside that platform’s workflows | Any system that asks before it acts: pipelines, agent hosts, sandboxes, your own services |
| What you can prove afterwards | Runtime logs | The approval record | Separate signed records of the decision, the permit verification, the execution and the effect, kept apart and marked observed only when observed |
These tools are complementary. AtlaSent uses identity, sandbox policy and existing approvals as inputs; none of them, alone, is the organization’s permission to act.
Developers
Gate an agent’s tool call today.
- Add the MCP server to your agent host, or put MCP Gate in front of another server’s tools to block risky calls locally, for free.
- Get a free API key and run your first evaluation to see hosted decisions against your organization’s rules.
- To require a verified permit before the tool runs, activate the action on Team Cloud or through the design partner program.
Free hosted decisions are advisory: a decision is recorded but no permit is issued, so nothing is blocked by the hosted service. Blocking on your own machine with the agent guard or MCP Gate is free and never requires payment.
Running agents across a team or organization?
AI Action Protection is offered through a design partner program. We start from your agents, the tools they can reach and the one action you most need to control, and confirm in the engagement exactly what is protected.