ACT: Agent Capability Tokens
OAuth for AI Agents — Fine-grained permissions, runtime enforcement, complete audit logs. The security layer that prevents unauthorized AI actions before they happen.
Trusted by developers building production AI agents
OpenAI
Anthropic
Google
Microsoft
Meta
Scale AI
Hugging Face
Stripe
OpenAI
Anthropic
Google
Microsoft
Meta
Scale AI
Hugging Face
StripeWhat is ACT?
ACT (Agent Capability Tokens) is the authorization and security layer for AI agents and LLMs. Just like OAuth protects user data, ACT protects against unauthorized AI agent actions.
Every AI agent gets a capability token that defines exactly what it can and cannot do. No more hoping your AI agent stays within bounds — ACT enforces permissions in real time, logs every action, and lets you revoke access instantly.
OAuth protects users
Controls what apps can do with user data
ACT protects from agents
Controls what AI agents can do with your systems
Complete AI Agent Security
Fine-Grained Permissions
Control exactly what each AI agent can do with capability-based access control.
Complete Audit Trails
Track every action your AI agents take with immutable, compliant logs.
Instant Revocation
Revoke AI agent access globally in real-time with zero latency.
Framework Agnostic
Works with any LLM, AI framework, or backend system seamlessly.
Built on Security-First Principles
Permissioned by Default
No AI agent operates without explicit security grants. Zero-trust model for agent authorization.
Observable by Design
Every action is logged with full context for compliance, debugging, and security analysis.
Revocable in Real Time
Instantly withdraw agent permissions when needed, with no propagation delays.
How It Works — At a Glance
ACT sits between your AI agent and your APIs, enforcing permissions in real time
AI Agent
GPT-4, Claude, Custom
ACT Gateway
Your API
Database, Email, Files
How AI Agent Security Works
4-step process to secure your LLMs and autonomous agents
Register Your AI Agent
Register your LLM or autonomous AI agent in the ACT platform
"GPT-4 Customer Support Bot"Define Security Policies
Specify exactly what actions the AI agent is permitted to perform
Actions: ["read", "list"]
Resources: ["api://crm/*"]Issue Capability Token
Generate a cryptographically signed capability token (JWT) for the agent
eyJhbGciOiJSUzI1NiIs...Enforce & Audit
Every AI agent action is validated against policies and logged for compliance
ALLOWED ✓ read
DENIED ✗ deleteSystem Architecture
Your Application
AI Agent / Backend Service
ACT Gateway
Your API
Customers, Orders, Data
🚨 Real Examples: What ACT Prevents
Without proper authorization, AI agents can take dangerous actions. Here's what ACT stops:
Email to External Domain — BLOCKED
Agent tried to send email to [email protected]
SQL Query Exceeding Row Limit — BLOCKED
Agent attempted SELECT * FROM users (1M+ rows)
Filesystem Access — BLOCKED
Agent tried to execute code with fs.readFileSync()
DELETE Request — BLOCKED
Agent hallucinated and tried DELETE /api/customers/all
Read Customer Data — ALLOWED
Agent requested GET /api/customers/12345
Create Support Ticket — ALLOWED
Agent created POST /api/tickets
⚡ 5-Minute Quickstart
Get up and running with ACT in minutes
Sign Up & Get API Key
Register at www.acttokens.comGet your API key from the dashboard
Create an Agent
POST https://api.acttokens.com/v1/agents
Authorization: Bearer {your-api-key}
{
"name": "Customer Support Bot",
"description": "Handles customer inquiries"
}Define a Policy
POST https://api.acttokens.com/v1/policies
Authorization: Bearer {your-api-key}
{
"name": "Read-Only CRM",
"actions": ["read", "list"],
"resources": ["api://crm/*"]
}Issue a Token
POST https://api.acttokens.com/v1/tokens
Authorization: Bearer {your-api-key}
{
"agentId": "agent-123",
"policyId": "policy-456",
"expiresIn": 3600
}Enforce Permissions
POST https://api.acttokens.com/v1/enforce
X-Api-Key: {your-api-key}
{
"token": "{capability-token}",
"action": "read",
"resource": "api://crm/customers/123"
}
// Returns: { "allowed": true }View Audit Logs
GET https://api.acttokens.com/v1/audit
Authorization: Bearer {your-api-key}
// Returns full audit trail of
// all agent actionsWhy Use ACT?
Security First
Fine-grained permissions prevent unauthorized actions
Full Audit Trail
Every action is logged with who, what, when, and why
Instant Revocation
Revoke access globally in real-time if agent misbehaves
Framework Agnostic
Works with any AI framework, LLM, or backend system
Time-Limited Access
Tokens expire automatically after set duration
Compliance Ready
Meet regulatory requirements with detailed logging
Why AI Agent Security Matters
As LLMs and autonomous agents take real-world actions, you need a robust control plane that keeps AI capability aligned with your security policies and compliance requirements.
- Reduce AI agent security risk without slowing down automation
- Unify authorization across multiple AI agents and LLM providers
- Enforce governance and compliance without custom integrations
- Meet regulatory requirements with immutable audit logs
- Maintain control over autonomous AI in production environments
🎯 Live Demo — See It In Action
Try ACT enforcement in real-time
Scenario Setup
Want to try it yourself?
Start Free — No Credit CardSimple, Transparent Pricing
Choose the tier that fits your deployment stage
Free Sandbox
Perfect for getting started
- 1 agent
- 500 actions/month
- 3 policies
- 7-day audit logs
- community support
Starter
Plus applicable taxes
For small teams
- Up to 5 agents
- 50,000 actions/month
- Unlimited policies
- 30-day audit logs
- EMAIL support
Add-ons: $10/agent
Growth
Plus applicable taxes
For growing organizations
- 25 agents
- 500,000 actions/month
- 90-day audit logs
- Rate-limit controls
- IP allow/deny lists
- PRIORITY support
Add-ons: $5/agent
Secure Your AI Agents Today
Join thousands of developers building production AI with ACT's security layer.