Airlock — WorkOS

Agents are dynamic. Permissions are static.

Least privilege requires hard-coding permissions. An agent's job is unknown until runtime, so teams settle for one of two extremes.

Manual approval

Safe, until you stop reading the prompts you're approving.

Allow this command?

1. Yes ❯ 2. Always allow· 3. No

?

YOLO mode

Fast, until the agent does something you can't undo.

$ agent --dangerously-skip-permissions

214 tool calls · 0 reviewed

With Airlock, you don't have to compromise.

Airlock derives permissions from intent.

No roles to assign, no scopes to pre-grant. Airlock authorizes agent access to all of your tools and integrations.

01

Intent

The task defines what the agent is allowed to do.

“Find last month's duplicate charges and refund them.”

02

Actions

The agent calls your tools and integrations as it works.

• search · charges, last 30 days
• refund · $1,240 in duplicate fees
• delete · customer record

03

Verdicts

Every call is judged against the intent and your rules.

• Allowed: search is read-only
• Needs approval: moves money
• Denied: outside the intent

?

Write rules in natural language. Enforce them on every request.

Static rules set fixed limits on your integrations. Runtime rules judge what static rules can't.

What should agents be allowed to do?

Agents can read repos, review code, and comment on PRs.

They can merge a PR when CI is passing, it has an approved review, and the change is small in scope.

Anything touching auth, billing, or migrations needs sign-off from the code owner.

Never push to main directly, and never delete branches.

Refine the rule…

Static Policies

Always in effect

• Allow GET
• Allow PUT /pulls/*/merge
• Deny POST /git/refs → main
• Deny DELETE

Runtime Checks

Judged per call

Check the PR first: CI must pass, has a review, and the diff is small.

Must be less than 200 lines and edit minimal files within a single domain.

Changes touching auth, billing, or migrations must be approved by the code owner.

Run agents securely across your organization.

Use Airlock to manage authorization for all your agents in one place, wherever they run.

Works everywhere

Airlock connects coding agents, custom harnesses, and AI teammates to every tool they need, without changing how they operate.

One set of rules for everyone

Policies live in one place and apply to every agent, on every team. Change a rule once and it takes effect across the organization.

Everything on the record

Every request and every verdict is logged, so security has a complete record of what agents actually do.

Put your agents behind Airlock.

Airlock is available in early access. Request access and tell us what you're building.

Request access

Watch the demo Play WorkOS Airlock: Intent-Based Access Control for AI Agents | Michael Grinich, Agent Night Keynote