AgentTrust documentation

A provider-agnostic trust layer that sits between any AI agent and the actions it wants to take. Any agent framework can use it over plain HTTP or the tiny TypeScript SDK.

The concept

Before an agent does something consequential — spend money, write to a database, email a customer — it asks the trust layer “am I allowed to do this?”. The trust layer answers allow, deny, or flag, and records the decision.

Identity

Every agent has an API key. Requests are authenticated and attributed.

Policy guardrails

Rules match on action, resource, and conditions to allow, deny, or flag.

Audit trail

Every request and decision is logged for accountability.

Quickstart

Create an agent & copy its key

Open the Dashboard → Agents tab, register an agent, and copy its atk_… API key. Store it as an environment variable in your agent app:

bash

AGENT_TRUST_KEY=atk_your_agent_key

Define policies

In Dashboard → Policies, add rules. A policy matches on an action (e.g. payment.*), a resource, and optional conditions (e.g. amount > 1000), then either denies or flags.

Call the API over HTTP

Any language, any runtime. Send the key and the action:

bash

curl -X POST https://YOUR-APP.vercel.app/api/evaluate \
  -H "Authorization: Bearer atk_your_agent_key" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "payment.send",
    "resource": "stripe",
    "params": { "amount": 5000, "currency": "usd" }
  }'

# Response (HTTP 403)
# {
#   "decision": "deny",
#   "reason": "Blocked by 1 deny policy: Block large payments",
#   "matchedPolicies": [ ... ]
# }

Or use the TypeScript SDK

Copy sdk/agent-trust.ts into your project — it has zero dependencies. Initialize once:

typescript

import { AgentTrust } from "./agent-trust"

const trust = new AgentTrust({
  baseUrl: "https://YOUR-APP.vercel.app",
  apiKey: process.env.AGENT_TRUST_KEY!,
})

typescript

// 1. Ask before acting
const { decision, reason } = await trust.check({
  action: "payment.send",
  resource: "stripe",
  params: { amount: 5000, currency: "usd" },
})

if (decision === "deny") {
  throw new Error(`Action blocked: ${reason}`)
}
// "allow" or "flag" -> proceed

typescript

// 2. Or wrap a tool so it is guarded automatically
const sendPayment = trust.guard(
  "payment.send",
  async (args: { amount: number }) => stripe.charge(args),
  { resource: "stripe" },
)

// Throws before charging if a deny policy matches
await sendPayment({ amount: 5000 })

Works with any agent framework

Because it is just an HTTP call, you can drop the check inside any tool. Here it is inside an AI SDK tool's execute:

typescript

import { tool } from "ai"
import { z } from "zod"

const sendEmail = tool({
  description: "Send an email",
  inputSchema: z.object({ to: z.string(), body: z.string() }),
  execute: async ({ to, body }) => {
    const { decision, reason } = await trust.check({
      action: "email.send",
      resource: "gmail",
      params: { recipient: to },
    })
    if (decision === "deny") return { error: reason }
    return mailer.send({ to, body })
  },
})

The same pattern applies to LangChain tools, CrewAI, or a custom loop: call trust.check(...) (or wrap the tool with trust.guard(...)) right before the side effect.

Deploy

1. Click Publish in the top-right of v0 to deploy to Vercel — no configuration required.
2. Your trust layer is live at https://your-app.vercel.app. Point agents' baseUrl at it.
3. Share agent API keys with each agent (as environment variables).

Data storage

Agents, policies, and logs currently live in an in-memory store, so data resets when the server restarts — perfect for evaluating the concept. The store sits behind a single TrustStore interface in lib/trust/store.ts. To make it durable, implement that same interface against Supabase and swap the exported store — the API routes, engine, and SDK do not change.

← Back to the dashboard