AI agents

Delegated signing with limits and approvals.

The problem

Why it matters.

AI agents increasingly act for people. When they borrow an application's credentials, nobody can tell what the agent did and what the application did.

With Roost

How Roost handles it.

Own identity

Each agent has its own identity, never borrowed.

Short-lived access

Only the keys and actions it needs.

Limits

Counts and amounts are capped.

APPROVED

Human approval

Risky actions wait for a person's passkey.

What you get

In the console.

Every action records: the agent did it, on whose behalf, approved by whom
Instant switch to cut off one agent
Unused agents expire automatically
Same audit chain as people and applications

axowl.com/dashboard/acme/roost/policies

AxowlacmeRoostM

Policy rules Record only

#	Keys	Who	Action	Effect
1	release-signing	ci-runner	sign	Require approval
2	data-key-*	orders-api	unwrap	Permit · audit
3	data-key-*	agent: ledger-bot	unwrap	Permit · limit 200/h
4	ca-*	anyone except Security officers	any	Deny · audit
5	*	*	export	Deny

Policy rules: who may do what, with approval, limits and exclusions. Record-only mode tries a rule before enforcing it.

See Roost refuse an unapproved signature.

A 30-minute live demo with our engineers.

Request a demo