Caveat — Agent-Aware Access Control
AI agents today borrow their human's credentials wholesale: a coding agent gets your entire GitHub token, your production database URL, your Slack workspace. Caveat is pre-action permissioning for agents — a local proxy that sits between the agent and upstream services and answers 'may this agent do X right now?' before every call. Agents hold only a CAVEAT_TOKEN; real credentials live exclusively inside the proxy (age-encrypted vault) and never reach the agent, the logs, or the cloud. Policies are written in YAML and compiled to a deterministic rule object evaluated purely and synchronously in-process — no network hop on the decision path. Sensitive actions can require human approval, pushed to Slack or the CLI with a 5-minute TTL that expires to DENY. Everything unmatched, malformed, or failing resolves to deny-by-default with a structured reason code.
Caveat — Agent-Aware Access Control
Frontend
Backend
Database
Tools
- • Agents need real credentials to be useful, but handing over a full-scope token makes every agent mistake a potential incident
- • Permission checks must add near-zero latency — a network hop on every tool call would make the proxy unusable
- • Approval flows have to interrupt the agent without killing it: block, ask a human, resume or deny
- • Credential material must be provably absent from every log line, error message, and payload
- • Single-binary TypeScript/Bun proxy: the agent talks to Caveat with a CAVEAT_TOKEN, Caveat injects real credentials upstream — they never flow toward the agent
- • Policy engine embedded in the proxy: YAML compiled to a deterministic rule object, evaluated purely and synchronously with table-driven tests for every allow/deny/approval path
- • require_approval actions block and push to Slack/CLI with a 5-minute TTL; expiry resolves to DENY
- • Deny-by-default everywhere: unmatched requests, malformed policies, and vault failures all deny with a structured reason code
- • Credential vault behind a CredentialStore interface (age-encrypted file v0) so 1Password/Vault backends slot in without touching call sites
Zero real credentials ever exposed to the agent — verified by grep-checked log/error paths in CI
GitHub + generic MCP passthrough adapters, with a cloud console for live request visibility
Designed for open source: clean adapter interfaces and a policy format built for a community registry
Other Projects
AI-powered job search platform: discover roles, evaluate fit, tailor applications, and close skill gaps. One-time pricing, no subscriptions.
View ProjectSee how much of your codebase no human understands. A treemap of your repo colored by human comprehension score, with a tracked, assignable metric for 'who understands what' in an AI-native codebase.
View Project