Your agents ship code. Who authorized the action?
AI coding agents now open PRs, edit workflows, write migrations, and trigger deploys. The hard question is no longer who wrote this code — it's should this action execute? Decionis answers it before anything runs: allow, block, or escalate.
The question has changed
Who wrote this code?
Code review, ownership, and ADRs answered authorship. Humans were the bottleneck, so review kept pace.
Who authorized this action?
Agents propose and execute faster than anyone can review. The control point moves from authorship to authority — a verdict before execution.
How the gate works
Agent proposes an action
A PR, a workflow edit, a migration, a deploy — anything an agent generates flows into your pipeline.
Decionis evaluates it
Against policy, required approvers, branch and environment, and risk — before the action executes.
Allow · block · escalate
A signed Decision Dossier records why, who approved, and which policy applied. Block holds it for a human.
Built on three primitives
Action Gate
One verdict before execution — allow, block, or escalate. Composes into any pipeline step.
Shadow Mode
Watch what your agents would have triggered without failing a build. Observe first, enforce when convinced.
Decision Dossiers
A signed, verifiable record of every agent action: why, who approved, which policy, what risk.
Gate agent changes in one step
Add the GitHub Action to the workflow your agents' PRs trigger. It detects agent-generated changes and posts a verdict on the PR — blocking or escalating the risky ones until a human signs off, while low-risk changes sail through.
- No build failures in shadow — observe first
- Signed proof on every agent action
- Allow / block / escalate, composable in later steps
- uses: decionis/govern@v2
id: gate
with:
api-key: ${{ secrets.DECIONIS_API_KEY }}
tenant-id: ${{ vars.DECIONIS_TENANT_ID }}
action: agent-pull-request
comment: "true"
payload: |
{ "author": "${{ github.actor }}", "agent_generated": true }Before your agent's code executes, decide whether it's allowed to.
No credit card, no call.
How do I decide what an AI agent is permitted to do?
Permissions for an agent are not a role, they are a decision taken per action. The same agent may read a document and not keep it, spend ten dollars and not ten thousand, deploy to staging and not production. What makes that enforceable is evaluating the specific action rather than granting the capability.
5 patterns answer this
Prevent AI overspending
An agent calls a paid API, provisions a resource, or loops on a task that bills per token.
Its gate and signals
Control MCP egress
An agent calls a tool that reaches a network destination, uploads a file, or posts data to a third party.
Its gate and signals
Gate agent memory and retrieval
An agent retrieves documents into context, or writes what it learned into durable memory.
Its gate and signals
Prevent destructive production changes
A command, script, or agent drops a table, deletes a bucket, or tears down infrastructure.
1 policy pack
Privileged access grant
An access request grants elevated or root scope to a person, contractor, or service.
1 policy pack
From this term to a governed action
- Prevent AI overspendingThe recurring action behind this term.
- Browse the policy packsThe bundles the evaluator ships, rule by rule.
- Try to break it in the sandboxA real signed verdict, no account.
- Deploy on your surfaceAvailable on 6 platforms today.
- Verify the proof yourselfCheck the signature without trusting us.
- Start NowMeasure on your traffic before enforcing.