- Tool
- prod.database.delete
- Action class
- CONSEQUENTIAL
- Policy
- Production destructive operations
- Decision
- REQUIRE_APPROVAL
AGENT ACTION VERIFIER
Open-source runtime security for AI agent actions.
Enforce locally. Cloud optional.
Approve consequential actions, isolate credentials, and prove what happened—with an Apache-2.0 enforcement runtime that works without an AAV Cloud account.
AAV Local alpha · Apache-2.0
SOURCEAI Agentaction.request()
AAVEVALUATION ENGINE
ROUTE LOCALPOLICY MATCHEDAPPROVAL REQUIRED
REQUIRE_APPROVALAUTHORIZED PATHVault → GatewayReal Tool
- 01TOOL_REQUESTED
- 02POLICY_EVALUATED
- 03APPROVAL_REQUESTED
- 04APPROVED
- 05TOOL_EXECUTION_STARTED
- 06TOOL_EXECUTED
- 07RECEIPT VERIFIED
THE AUTHORITY GAP
Credentials unlock systems. They do not define intent.
AI agents can call APIs, modify databases, send email, deploy software, manage infrastructure, trigger business workflows, and use MCP tools. Giving an agent a credential is not the same as giving it permission to do everything that credential allows.
THE AAV LOCAL MODEL
A local enforcement boundary between intent and execution
The agent requests an action. AAV Local evaluates explicit policy and, when configured, pauses for human approval. The action executes only when authorized.
01Agent requests action
→tool.execute()02AAV Local evaluates itPOLICY · RISK · GRANT · APPROVAL
→03ALLOW · DENY
REQUIRE_APPROVAL
→REQUIRE_APPROVAL
04Authorized executionVAULT · GATEWAY · TOOL
AI Agent↓ AAV API KeyAAV↓ authorized onlyCredential Vault↓ injected server-sideExternal System
CREDENTIAL ISOLATION
Your agent doesn't need your downstream credentials.
AAV Local stores vault-backed credentials encrypted with AES-256-GCM and unlocks them with AAV_VAULT_PASSPHRASE. A credential is decrypted just in time for an authorized action and is never returned to the agent. Environment-variable references remain supported.
HUMAN-IN-THE-LOOP
The agent cannot approve itself.
High-risk actions pause for independent human review. An approver can allow or reject the request; execution continues only after approval.
CONSEQUENTIAL ACTION REQUIRE_APPROVAL→Human reviewApprove / Reject→OUTCOMEExecution / Block
LOCAL POLICY
Explicit policy at the local action boundary
AAV Local applies ALLOW, DENY, or REQUIRE_APPROVAL before a routed tool executes. It also records deterministic local risk evidence and can consume exact scoped execution grants, but neither grants nor risk can override DENY.
Illustrative local policy — not customer data
- Tool
- customer.email.send
- Action class
- ROUTINE
- Decision
- ALLOW
- 01RUN_STARTED
- 02TOOL_REQUESTED
- 03POLICY_EVALUATED
- 04RISK_EVALUATED
- 05EXECUTION_GRANT_CONSUMED
- 06APPROVAL_REQUESTED
- 07TOOL_EXECUTED
- 08RUN_FINISHED
Receipt
{
runId,
eventCount,
finalChainHash,
issuedAt
}AUDIT + RECEIPTS
Every protected action creates an auditable Run.
AAV records an ordered event history and issues a receipt with a tamper-evident hash chain. This lets you verify the integrity of the history recorded by AAV.
DEVELOPER EXPERIENCE
Start with AAV Local.
Install the open-source CLI and run enforcement, approvals, the stdio MCP proxy, the encrypted local vault, audit, and receipts locally. No Cloud account is required.
terminal
npm install @agentactionverifier/cli@alpha
npm install @agentactionverifier/cli@alpha
npx aav init --name "My protected agent"
npx aav doctorAAV Local currently supports MCP over stdio. The AAV Cloud SDK/API remains a separate hosted integration.
AAV CLOUD SDK / API
AAV Cloud
Local first, with optional hosted integration
cloud-example.ts
npm install @agentactionverifier/sdk@beta
import { AAVClient } from "@agentactionverifier/sdk";
const aav = new AAVClient({
apiKey: process.env.AAV_API_KEY!
});
const result = await aav.tools.execute({
toolKey: "send-email",
idempotencyKey: "customer-8472-email",
input: {
to: "customer@example.com"
}
});SDK · REST · MCP
Local first, with optional hosted integration
SDK
AAV Cloud Node.js / TypeScript SDK
@agentactionverifier/sdkREST API
AAV Cloud HTTP interface
https://api.agentactionverifier.comMCP
AAV Cloud MCP endpoint
https://api.agentactionverifier.com/v1/mcpUSE CASES
Built for agents with real operational reach
- 01Coding agents
- 02Infrastructure agents
- 03Customer support agents
- 04Internal automation
- 05AI workflows
- 06MCP-enabled agents
- 07Business operations
SECURITY MODEL
Local security controls for the action path
Layer inspectable controls around actions without handing unrestricted downstream authority to the agent.
- ✓Default deny
- ✓ALLOW / DENY / REQUIRE_APPROVAL
- ✓Deterministic local risk evidence
- ✓Scoped local execution grants
- ✓Human approvals
- ✓Encrypted local credential vault
- ✓JIT credential isolation
- ✓MCP stdio security proxy
- ✓Idempotency controls
- ✓Tamper-evident audit chain
- ✓Receipts and offline verification
- ✓SQLite local persistence
AAV controls internal continuation and idempotency. It does not promise universal exactly-once execution for external side effects.
AAV / 2026
Why the runtime is open source
AAV began as a private product. During development, we concluded that this security boundary should not depend on access to a proprietary hosted service. The enforcement runtime is therefore open source under Apache-2.0. AAV Cloud remains optional for hosted centralized management, collaboration, and visibility.
HONEST SECURITY BOUNDARY
Scope and current limitations
- —AAV enforces only actions routed through AAV.
- —If an agent retains bypass credentials or network access, AAV cannot enforce that bypass.
- —AAV does not claim to prevent prompt injection; it limits consequences at the action boundary.
- —There is no universal exactly-once guarantee for external side effects.
- —AAV Local alpha currently supports MCP over stdio.
- —DNS rebinding certification remains incomplete.
PLANS
Open source locally. Hosted management when you need it.
AAV Local is free and is not artificially metered by AAV Cloud plans. Starter, Professional, and Business are AAV Cloud subscriptions whose prices and capabilities come from the live Cloud catalog.
A protected action is a tool execution routed through AAV controls.
I have an AAV Cloud access codeOpen Source / Local
Run locally under Apache-2.0 with no Cloud account. Local agents, tools, and actions are not metered by AAV Cloud plans.
$0Apache-2.0
- ✓Local-first enforcement
- ✓MCP stdio proxy
- ✓Local risk evidence and scoped grants
- ✓Local human approvals
- ✓Encrypted local credential vault
- ✓Local backup / verify
- ✓Local audit chain and receipts
- ✓Offline receipt verification
AAV CLOUD PLANS
Starter
For teams starting to protect AI agent actions.
$9.99 / monthIncluded Cloud usage
5,000 Cloud protected actions / month
Included Cloud resources
- 2 Cloud agents
- 10 Cloud tools
- 3 Cloud members
Included Cloud capabilities
- ✓Cloud API / SDK
- ✓Cloud human approvals
- ✓Cloud Risk Engine
- ✓Cloud Dry Run
AAV CLOUD PLANS
Professional
For teams deploying AI agents with advanced governance and control.
$14.99 / monthIncluded Cloud usage
50,000 Cloud protected actions / month
Included Cloud resources
- 10 Cloud agents
- 30 Cloud tools
- 10 Cloud members
Included Cloud capabilities
- ✓Cloud API / SDK
- ✓Cloud human approvals
- ✓Cloud Risk Engine
- ✓Cloud Dry Run
- ✓Cloud MCP
- ✓Cloud Execution Grants
- ✓Cloud Policy Simulator
AAV CLOUD PLANS
Business
For organizations operating AI agents at scale with complete controls.
$29.99 / monthIncluded Cloud usage
250,000 Cloud protected actions / month
Included Cloud resources
- 50 Cloud agents
- 150 Cloud tools
- 50 Cloud members
Included Cloud capabilities
- ✓Cloud API / SDK
- ✓Cloud human approvals
- ✓Cloud Risk Engine
- ✓Cloud Dry Run
- ✓Cloud MCP
- ✓Cloud Execution Grants
- ✓Cloud Policy Simulator
Compare AAV Cloud plans
| Starter | Professional | Business | |
|---|---|---|---|
| Cloud protected actions / month | 5,000 | 50,000 | 250,000 |
| Cloud agents | 2 | 10 | 50 |
| Cloud tools | 10 | 30 | 150 |
| Cloud members | 3 | 10 | 50 |
| Cloud API / SDK | ✓ Included | ✓ Included | ✓ Included |
| Cloud human approvals | ✓ Included | ✓ Included | ✓ Included |
| Cloud Risk Engine | ✓ Included | ✓ Included | ✓ Included |
| Cloud Dry Run | ✓ Included | ✓ Included | ✓ Included |
| Cloud MCP | — Not included | ✓ Included | ✓ Included |
| Cloud Execution Grants | — Not included | ✓ Included | ✓ Included |
| Cloud Policy Simulator | — Not included | ✓ Included | ✓ Included |
Your agents are getting more powerful.