Early-stage concept · Recruiting design partners
Let agents move fast. Keep the final say.
ActionWarden is a proposed approval gateway for AI agents. Routine work flows through. When an agent tries something consequential, it pauses for a person to decide — and the decision is recorded.
Coverage applies only to execution paths routed through an enforcing integration.
Approval request
Product concept — sample dataSend “Your plan is changing” email
- Agent
- support-assistant
- Tool call
email.send_bulk- Target
- 1,284 customers · segment: annual-plan
Reason for review
Outbound message to more than 100 external recipients.
- SubjectYour plan is changing on Dec 1
- Recipients1,284
- Sends asBilling team
Proposed: if no one decides within the agreed window, the action is denied.
Where it matters
Most agent actions are fine. A few should wait for you.
The checkpoint is meant for the handful of actions that are hard to undo, touch customers, or change who can do what.
Sending customer emails
An agent drafts a pricing notice and queues it for 1,200 accounts. A wrong segment reaches real inboxes and cannot be unsent.
Deleting records
A cleanup agent decides a list of contacts is stale. Hard deletes in a CRM or database are often permanent.
Changing access
An IT agent adds a user to an admin group to resolve a ticket. Privilege changes deserve a second pair of eyes.
Starting consequential workflows
An operations agent kicks off a payout batch, a refund run, or a deployment. Once started, side effects ripple outward.
The problem
Tool permission is not business approval.
To be useful, an agent needs real credentials: the email API, the CRM, the identity provider. Those credentials say what the agent can do. They say nothing about whether a specific action, right now, is a good idea.
Teams end up choosing between narrow permissions that make agents useless, or broad ones that let a single bad plan reach customers. A checkpoint in between is the gap ActionWarden explores.
| Dimension | Tool permission | Business approval |
|---|---|---|
| Asks | Can this agent call this tool? | Should this happen — now, to these people? |
| Granted | Once, when credentials are issued | Per action, with the specifics in view |
| Knows | Scopes and endpoints | Context, timing, and business risk |
| Leaves behind | An API log entry | A decision with a named reviewer |
Proposed workflow
Three steps between the agent and the consequence.
This is the flow we want to validate with pilot partners. Enforcement, timeouts, and approval records are proposed pilot capabilities, not features proven in production.
- Step 1
Define a sensitive-action boundary
Together we name the specific tool calls that need review — for example, any email to more than 100 recipients, or any delete in production.
email.send_bulk where recipients > 100 - Step 2
Pause for a reviewer’s decision
When the agent reaches that boundary, the call is held. A designated reviewer sees the action, target, and reason, then approves or denies.
status: paused → awaiting reviewer - Step 3
Record the outcome
The decision, reviewer, time, and any note are written to an approval record. The agent continues, or receives a clear refusal.
outcome: denied · by: reviewer · 10:42
What’s different
Narrow on purpose.
ActionWarden isn’t trying to monitor everything an agent does. It focuses on the moment before a consequential call.
Decisions at the level of a single action
Not a role, not a session, not a blanket scope. The reviewer sees this email, these records, this access change — and decides on exactly that.
A boundary inside the execution path
The goal is a checkpoint the call must pass through, not a dashboard that observes after the fact. Where the path is routed through the gateway, a held action does not run until someone decides.
Built with a few design partners
We are working closely with a small number of teams on one workflow each. You shape the boundary rules, reviewer experience, and record format.
Early pilot
One workflow. Clear limits. Shared definition of success.
A focused pilot to find out whether an approval checkpoint is useful for your team — without asking you to route everything through it.
One controlled workflow
We start with a single agent workflow and one or two sensitive actions — ideally in a staging or limited-production environment.
A technical owner on your side
An engineer who knows the agent’s tool layer and can route the chosen execution path through the gateway.
Agreed safeguards
Before anything runs, we agree on what is gated, who reviews, the timeout behavior, and how to switch the pilot off.
Written success criteria
We define what “worked” means up front — for example, review latency, false-positive rate, and reviewer confidence.
Coverage depends on routing the selected execution path through an enforcing integration. Actions that reach the target system by another route are not gated. ActionWarden is not a replacement for least-privilege credentials.
FAQ
Straight answers about where this stands.
Is ActionWarden available today?
No. ActionWarden is an early-stage concept. We are validating the problem and the proposed workflow with a small number of design partners. There is no generally available product, and nothing described on this page is proven in production.
Which agent frameworks and tools does it integrate with?
There are no generally available integrations yet. In a pilot, we would scope an integration for your one chosen workflow — for example, wrapping a specific tool call in your agent framework or API layer. Whether that is feasible depends on your stack, which is why the application asks about it.
Can an agent bypass the approval checkpoint?
Yes, if it can reach the target system another way. The checkpoint only applies to execution paths routed through an enforcing integration. If an agent holds credentials that let it call the same system directly, that call is not gated. Part of a pilot is mapping those paths together and narrowing credentials where possible.
What happens if nobody responds to a request?
The proposed default is to fail closed: if no decision is made within an agreed window, the request expires and the action is denied, and the agent receives a clear refusal. The window, any escalation, and notification channels would be agreed per pilot. This behavior has not been proven in production.
What are the commercial terms?
There is no published pricing. Pilot terms are discussed individually with each design partner, and we will be explicit about any costs or commitments before you agree to anything.
Do you hold security certifications like SOC 2 or ISO 27001?
No. ActionWarden does not hold SOC 2, ISO 27001, or any other certifications or attestations. During a pilot we will describe exactly which controls are and are not in place so you can decide what is appropriate to route through it.
What should I avoid sending in the application?
Please do not include credentials, API keys, tokens, customer data, or real payloads. A plain-language description of the action and the names of your tools is all we need.
Apply
Apply for an Early Pilot.
Tell us about one agent workflow and the action you'd most want a human to approve.
What happens next
- We read every application ourselves.
- If it looks like a fit, we follow up to schedule a short scoping call.
- Together we decide whether a pilot makes sense — no obligation either way.