agent-safe-pipeline
Reference architecture for AI agents that propose actions but cannot authorize them — immutable intent capture, an independent Decionis policy verdict (ALLOW/ESCALATE/BLOCK), verified human approval, and a SafeExecutor that consumes a single-use intent-bound grant.
- stars
- 532
- 30-day movement
- -1-0/day
- Related entries
- 62
- Connections
- 1
agent-safe-pipeline is a reference architecture and MCP server (TypeScript, Node/pnpm) in which AI agents propose actions but cannot authorize them. The pipeline captures immutable intent, obtains an independent Decionis policy verdict (ALLOW/ESCALATE/BLOCK), requires verified human approval, and runs a SafeExecutor that consumes a single-use, intent-bound grant.
Reach for it when you want a concrete, policy-as-code pattern for separating agent proposal from execution authority with human-in-the-loop approval.
Use it to
- Gate agent actions behind policy verdicts
- Require verified human approval for escalations
- Enforce single-use, intent-bound execution grants
- Model authorization flows as a reference architecture
- Run the pipeline as an MCP server
For Teams building governed, human-supervised AI agent systems
- Role
- mcp-server
- Language
- TypeScript
- Licence
- Apache-2.0
- Forks
- 57
- Open issues
- 14
- Last push
- 2026-09-16
- Latest release
- v0.1.0 · 2026-08-15