Use cases

AI agents

Give a model bounded authority instead of a credential and a prompt.

The problem

An agent needs to act — buy, refund, schedule, move data. Whatever you hand it becomes its ceiling, and a model's ceiling should not be your entire API surface.

Prompt injection is not a hypothetical. The agent reads documents, and documents can contain instructions.

Without Bengar

• An API key with the union of everything the agent might ever need.
• Guardrails in the prompt, which are advisory.
• A code review of the tool wrapper, which is a control that runs once, at a time nobody was under pressure.
• After an incident: logs that say what happened and cannot say what was permitted.

With Bengar

• A permit: actions, resources, per-transaction and total limits, an expiry.
• A policy that can tighten today without reissuing anything.
• REQUIRE_APPROVAL above a threshold, discharged by a named person who signs what they saw.
• A freeze that takes effect on the next authorization.
• An audit trail with the reason for every refusal, provable against an anchor.

The flow

1. The agent presents its permit and asks to act.
2. Permit ∩ Policy ∩ Risk produce one decision.
3. ALLOW executes with an idempotency nonce; DENY stops; REQUIRE_APPROVAL waits for a person.
4. The decision is recorded either way.

Components used

Permits · Policy · Approvals · Execution · Audit

Example

const decision = await bengar.authorize({
  agent:    process.env.AGENT_DID!,
  permit:   process.env.AGENT_PERMIT!,
  action:   "purchase",
  resource: `resource://company/procurement/${sku}`,
  amount:   { minor: priceMinor, currency: "TRY" },
  execution: {
    merchant:  "acme-procurement",
    operation: "create_purchase_order",
    payload:   { sku, quantity },
    nonce:     orderId,
  },
});

if (decision.decision !== "ALLOW") {
  // REQUIRE_APPROVAL is not an allow.
  return { status: decision.decision, reason: decision.reason_code };
}

Security properties

Try it →