typed authority requests · human execution

Authority without handing agents the keys.

Airlock gives untrusted AI agents a narrow way to ask for privileged work. A trusted node validates the request. A human decides. A human executes. Credentials never cross the boundary.

Install the integrations See the approval path

Trusted-execution by design. An execution receipt is not external proof.

request / review / verify trusted execution

Agent requestsexact typed capability fields

Trusted node validateslocal adapter, constraints, expiry

human authority boundary

Human reviewsapprove or reject reconstructed action

Trusted node executesdirect argv after persisted human approval

Verifier observesindependent read-only external state

The boundary

Requests can cross. Authority cannot.

The requester side can discover signed capabilities, submit bounded typed requests, and read sanitized receipts. It cannot receive trusted credentials, approval tokens, provider execution URLs, or requester-supplied shell access.

Typed, not arbitrary

Each capability has a strict schema and local trusted adapter. There is no generic command field hiding under a nicer name.

Human at both gates

A reviewer grants or rejects authority. After approval, Airlock directly runs the locally reconstructed configured argv.

Receipts are not reality

executed records a trusted child success. A separate read-only observation establishes the external result.

How it works

One narrow path through the wall.

Airlock keeps model-facing integration boring on purpose: three tools, loopback transport, typed state, and no automatic escalation when another tool fails.

Discover

The agent calls airlock_capabilities and treats every returned label and description as untrusted data.

Request

The agent submits exact typed fields through airlock_create_request. The requester persists an immutable ID, digest, nonce, and bounded expiry.

Review and act

The trusted node revalidates local constraints and renders an exact direct-exec plan. A human reviews it, then Airlock executes it after persisting the reservation.

Observe

The agent reads sanitized state through airlock_requests, then verifies the intended effect through a separate ordinary read-only path.

Cross-harness

Same contract. Native surfaces.

Claude Code and Codex use the typed stdio MCP server plus a shared compact skill. Hermes uses a thin native plugin with the same three tools and an optional bounded prompt section.

3model-facing tools

0execution hooks

0generic shell fields

1explicit human path

Explicit opt-in

Install awareness without smuggling authority.

The happy path opts into managed user-global guidance. The installer default remains --instructions skip; it never edits project-local instructions.

terminalstdlib-only bootstrapper

python3 tools/airlock_bootstrap.py install \
  --binary /absolute/path/to/airlock \
  --instructions install