Cedar-powered policy evaluation for every tool call. Tamper-evident audit, scoped delegation, JWS-signed tokens. Drop in a CLI, mount a sidecar, or embed the engine in-process — the same decisions, the same chain.
Standards-native · interop-first
Once an agent can call tools, every call is a decision. Who made it. What was allowed. With what context. Whether the policy the security team wrote yesterday still applies today.
Most stacks answer those questions with imperative code, scattered logs, and vendor-specific protocols. By the time an incident lands, the chain is broken and the audit is unreadable.
agent-guard moves authorization out of the application and into a verifiable, standards-native engine — one chain for every decision, every surface, every agent.
How it works
Every tool call flows through the same pipeline, regardless of surface.
Every tool call passes through one of four surfaces — TypeScript SDK, AuthZEN HTTP, CLI, or the admin console — bound to a short-lived identity (JWT, DPoP, SPIFFE, API key).
principal: Agent::"research"
action: ToolCall::send_email
resource: Mailbox::"alice@acme"
The Cedar engine resolves entities against a typed schema, walks the policy bundle, and produces an explicit Allow or Deny. Hot-reloaded, versioned, blast-radius-checked.
policy 20_agents.cedar (v7)
forbid(principal, action, resource)
when { principal.scope excludes resource }
Every decision is appended to a hash-chained log with a JWS-signed envelope. Verify the chain end-to-end; export to ECS, CEF, LEEF, or JSONL for your SIEM.
decision_id: 0x9f4a
prev_hash: 0x71c2
hash: 0xa3b8… (HMAC-SHA-256)
// forbid a sub-agent from sending email outside its delegated scope
forbid(
principal in Agent::"research",
action == Action::"send_email",
resource in Mailbox::"*"
)
when { principal.scope.mailboxes excludes resource };Everything you need to put a verifiable authorization boundary around an agent — no bespoke plumbing.
Every tool call is an explicit Cedar decision — principal, action, resource, context. Allow runs the tool, deny raises AuthorizationDenied back to the model.
Every decision is appended to a hash-chained log. Verify the chain end-to-end, export to CEF, LEEF, ECS, or JSONL for your SIEM.
A parent agent gives a sub-agent a scoped subset of permissions, time-boxed, sender-constrained (DPoP), and revocable.
Security teams write Cedar policies, not imperative code. Validated at authoring time against a typed schema of entities, actions, and context shapes.
JWT, OIDC, API keys, DPoP, SPIFFE — RFC 8725 BCP crypto, RFC 8693 token exchange, no proprietary protocols.
Push policies without downtime. See what would break before you push, roll back instantly, observe decisions as OTel spans.
The TypeScript SDK, the AuthZEN HTTP PDP, the CLI subprocess, and the admin console all converge on the same Cedar engine. Authorize from anywhere — the audit doesn't know the difference.
import { Client, Principal, Action } from "agentguard";
const client = new Client({ store: ".agentguard" });
const decision = client.check(
Principal.user("alice"),
Action.tool("send_email"),
{ entity_type: "Mailbox", uid: "alice@acme" },
{ args: { to: "bob@acme.dev" }, session: { ip: "10.0.0.1", mfa: true } },
);
// → Allow
// Scoped delegation (RFC 8693, JWS-signed, time-boxed):
await client.delegate(
'Agent::"research"',
'Agent::"summarizer"',
["ToolCall::send_email"],
["Mailbox::*"],
300, // seconds
);Append-only, HMAC-linked, JWS-enveloped. Verify the chain at any time. Export to your SIEM in the format it already speaks.
agentguard audit verify \ --audit .audit/decisions.jsonl \ --secret-file .chain-secret # ✓ chain integrity verified # 12,481 records · head 0xa3b8…
SDKs, the HTTP PDP, the CLI, and the admin console all converge on the same Cedar core and the same hash-chained audit.
Principal · action · resource · context. Short-lived identity (JWT, DPoP, SPIFFE, API key).
Typed Cedar schema. Versioned policy bundles. Hot reload with blast-radius check.
Allow · Deny · StepUpRequired. OTel span with authz.* attributes. Append to hash-chained log.
No proprietary wire protocols. Every piece is the RFC, the working-group draft, or the maintained open-source implementation.
Integrations
TypeScript SDK + BeforeToolCallEvent hook guards every tool invocation through the AuthZEN PDP.
Spawn the CLI in-process from any Node.js agent. DPoP-bound bearer tokens, JWS-signed delegation.
Mount the AuthZEN PDP router inside your existing Rust service via agentguard_server::build_router.
Next.js 16 dashboard with OIDC sign-in, policy simulator, delegation console, audit browser.
Open-source under Apache-2.0. Three patterns that cover almost every deployment shape we've seen.
Open-source under Apache-2.0. Drop the CLI into your agent, ship a sidecar, or embed the Cedar engine in-process. Files in .agentguard/ are the source of truth.
agentguard serve speaks OpenID AuthZEN over HTTP and gRPC. Use it with any language, any gateway, any federation tool that speaks AuthZEN.
Mount the agentguard-server router inside your existing axum app. The same Cedar engine, the same audit chain — without an extra hop on the data path.
Ship it
Apache-2.0, no proprietary protocols, no vendor lock-in. Drop in the CLI, run the sidecar, or embed the engine — the chain stays the same.