Agent identity
Descope Agentic Identity Hub
Descope filters scopes when it issues or exchanges a token. Decionis binds authority to the exact action and re-evaluates before commit.
Architecture field guide
Start with the control you need
Identity, permissions, security inspection, operator consent and action authority solve different problems. A useful comparison starts with your execution boundary.
Checked 2026-09-16. Decionis is for exact-action authority and portable decision evidence. It is not an identity provider, a coding workspace or an estate-wide agent discovery platform. Its records are Ed25519-signed Decision Dossiers, and approved actions run on single-use execution grants. Corrections welcome.
Which control answers your question?
Identity and access management
Who is acting, and which systems may they reach?
Compare responsibilities →AI guardrails
What risk is present in prompts, outputs or behavior?
Compare responsibilities →Policy engines
How should an application evaluate authorization rules?
Compare responsibilities →GRC systems
How do teams manage controls, risk and assurance evidence?
Compare responsibilities →Approval workflows
How does a person’s decision become permission for one action?
Compare responsibilities →Execution Authority evaluates whether an exact action may commit under your policy. These controls can work together; the right choice depends on the boundary you need to protect.
Application authorization
Permit.io
Model application permissions with Permit; bind a consequential execution and its evidence with Decionis.
Coding-agent workspace
HumanLayer
HumanLayer organizes collaborative coding-agent work. Decionis governs authority for an exact consequential action.
Agent security platform
Zenity
Zenity covers an agent estate before, during and after execution. Decionis concentrates on an exact action's authority and portable evidence.
Agent component security
Snyk Agent Scan
Agent Scan discovers and assesses agent components. Decionis checks whether an exact proposed action has authority to execute.
Security gateway
Lasso MCP security gateway
An MCP security gateway inspects traffic at a proxy; an execution authority binds permission to the proposed action and records signed evidence.
Policy engines
OPA and Cerbos
A policy engine can evaluate rich action context. Decionis adds an execution lifecycle and a portable record around the decision.
Application authorization
Oso
Oso models application authorization. Decionis binds a policy decision to one proposed consequential execution.
Build versus adopt
building it yourself
The build decision includes the executor, replay protection and evidence lifecycle, not only the policy if-statement.
Operator consent
MCP approval prompts
A client confirmation asks a person to approve a call. The separate engineering question is how the server binds and enforces that approval.
Human approval workflow
manual maker-checker
Keep the second-person control where it adds judgement. Bind that approval to the action that actually reaches execution.
Check the evidence
Verify this yourself — no account, works offline
This preloaded dossier has real Ed25519 signatures over synthetic data from the public Agent-Safe corpus. Its test key is deliberately public. It demonstrates verification and tamper detection; it is not customer evidence, a production signature, or permission to execute.
Ready to check locally
npx -y @decionis/verify --file OwnedExecutionBound.json --jwks Jwks.json
After the page or files load, the signature checks need no network. Installing the CLI may require a connection. Valid signatures establish integrity relative to the selected key, not whether the original facts were true.