PaloNexus is an authorization and accountability service for AI-agent actions — the
identity governance layer between AI agents and the systems they act upon. It decides
authority, not routing: whenever an agent attempts an action — a model call, a tool
call, an agent→agent hop — one deny-by-default /authz decision answers may this agent
make this call, on behalf of this human, for this task, right now? Behind that answer sits
the authority graph: whose authority the agent is using,
whether that person was entitled to delegate it, and whether the delegation is still valid
at this moment.
Agent runtimes decide how an agent works. Sandboxes decide where its code runs. PaloNexus decides what it is authorized to do and whose authority it is using.
PaloNexus makes sure an AI agent can act only with authority that a real person or service owner was entitled to delegate—and only for the task, resource, and time originally approved.
PaloNexus is not an agent runtime and not a sandbox — it is the layer that governs what either is allowed to do with real enterprise systems:
| Layer | What it owns | Examples |
|---|---|---|
| Agent runtime | How an agent works — prompting, tool routing, memory, orchestration | LangChain, LangGraph, Deep Agents, OpenAI Agents SDK, kagent |
| Sandbox | Where its code runs — isolated filesystems, command execution, workspace lifecycle | Kubernetes Agent Sandbox, E2B, Daytona, Modal |
| PaloNexus | What it is authorized to do and whose authority it is using — accountable ownership, delegation, just-in-time credentials, revocation, authority trail | Works alongside all of the above |
Keep the existing runtime and sandbox — PaloNexus complements both. See What PaloNexus is not for the honest category boundaries.
| Concept | What it means | Learn more |
|---|---|---|
| Agent identity | Every agent gets a signed, verifiable identity of its own — it never borrows a human’s account. | Agent identity & credentials |
| Owner & delegation | Every agent names an accountable human owner and sponsor; it may receive only authority an entitled human was permitted to delegate. | Authority delegation |
| Task-scoped credential | Access is issued just-in-time for one task, one resource scope, and a short time window — never a standing credential. | Core concepts |
| Decision | Every action resolves at one deny-by-default /authz answer: allow, deny, or needs human approval. | The authorization model |
| Authority trail | Every verdict is recorded on a hash-chained, tamper-evident log traceable from agent to task, delegation, approver, and outcome. | Security model |
An agent attempts an action — a model call, tool call, agent→agent hop, or API request.
The call reaches the deny-by-default /authz decision point — via an SDK guard, the
egress proxy, or Envoy’s external-authorization hook (ext_authz) at the gateway. There
is no path around it.
PaloNexus resolves the agent’s identity, its accountable owner, and the on-behalf-of subject the task is bound to.
Policy evaluates the task, action, resource, allowlists, budgets, and any active delegation. No valid authority means deny — or needs approval when a human could grant it.
On needs-approval, a human whose entitlement is verified grants a time-boxed, task-scoped delegation; the re-checked call passes on that approver’s behalf and the access expires automatically.
The verdict — allow or deny, and every approval and expiry around it — lands on the tamper-evident authority trail.
The same loop in one picture — the workforce identity provider (IdP) owns the humans, PaloNexus owns the agents, and one decision connects them:
flowchart LR
L[Workforce IdP<br/>owns humans<br/>Okta · Entra ID · Logto…] -->|owner + sponsor| P[PaloNexus<br/>owns agents]
P -->|outbound call:<br/>deny-by-default| Z{authz}
Z -->|needs approval| H[Human delegates<br/>task-scoped access]
H -->|approve, time-boxed| E[Temporary elevation<br/>Delegation VC]
E -->|allow, on-behalf-of| Z
Z -->|every decision| A[(Audit<br/>proves control)]
The PaloNexus control loop: the workforce IdP — Logto is the supported IdP — owns
humans, PaloNexus owns agents, a human delegates task-scoped access, an approval turns a
denial into a time-boxed elevation, and every /authz decision is proven on the audit chain.
Any IdP speaking OpenID Connect (OIDC) and SCIM (System for Cross-domain Identity
Management) plugs in the same way — see
Connect agents to enterprise authority.
The same one authorization contract also gates inbound (north–south) requests entering the
gateway — may this caller reach this service? via Envoy ext_authz. That ingress
capability is the foundation egress governance is built on; the gateway, ingress, and
Kubernetes wiring behind it are deployment mechanics covered in
Self-host & operate.
PaloNexus is two complementary halves. Agents are built and integrated with the palonexus SDK —
a typed, framework-aware front door that wraps every model, tool, and agent-to-agent call an
agent makes, with typed deny/approve and an offline() mode for tests. The platform then
authorizes each of those calls at one deny-by-default /authz, drawing identity from
the workforce IdP (humans) and PaloNexus (agents). A denial becomes a time-boxed
elevation only when a human with the authority to approve it does — and every decision lands
on the authority trail.
flowchart LR
subgraph build["① Build + integrate · palonexus SDK"]
direction TB
agent["AI agent<br/>LangChain · LangGraph · Deep Agents"]
sdk["palonexus SDK<br/>register · provision · task.check / authorize<br/>framework guards · typed deny · offline tests"]
agent --> sdk
end
subgraph run["② Authorize + prove · PaloNexus platform"]
direction TB
authz{"/authz<br/>deny-by-default"}
idp["agent-idp<br/>agent identity · delegations"]
audit[("Authority trail<br/>tamper-evident chain")]
authz --> audit
end
wf[["Workforce IdP<br/>owns humans · OIDC / SCIM"]]
human(["Human owner / approver"])
target["Model · Tool · Agent-to-agent"]
wf -. "owner + sponsor" .-> idp
sdk == "every outbound call" ==> authz
authz -- "allow · on-behalf-of" --> target
authz -. "needs approval" .-> human
human -- "approve · time-boxed" --> idp
idp -- "delegation credential" --> authz
Two halves of one system, with PaloNexus sitting between agents and the systems
they act upon. The SDK (①) is the build surface — a guard drops into LangChain, LangGraph,
or Deep Agents and the whole flow runs offline. The platform (②) is how every action is
authorized: the thick arrow is the single integration point — every outbound agent action
flows through /authz, which resolves the agent’s identity and its owner’s authority, asks
an entitled human to approve a time-boxed delegation when a regulated target needs one, and
records the verdict on the authority trail.
See Integrations for the per-ecosystem pages, and the Feature matrix for what ships today, what is opt-in, and what is planned — tracked row by row.
| Pillar | What it guarantees |
|---|---|
| Accountable ownership | Every production agent has an active accountable owner and an organizational sponsor. |
| Authority-bound delegation | An agent may receive only authority that an entitled human, group, or service owner is permitted to delegate. |
| Just-in-time access | No standing enterprise credentials. Access is issued for one task, target, action set, and short time window. |
| Lifecycle-linked revocation | Human and organizational changes cascade immediately into agent access and ownership state. |
| Verifiable authority trail | Every action can be traced from the agent to the task, delegation, approver, policy, runtime credential, and target outcome. |
Network enforcement, signed credentials, Decentralized Identifiers (DIDs), Verifiable Credentials (VCs), Open Policy Agent (OPA), Envoy, and Kubernetes are implementation mechanisms beneath these pillars — they are how the guarantees are enforced, not what the product is.
Beneath the pillars, six cooperating mechanisms — gateway, identity, registry, policy,
observability, audit — converge on the single /authz answer:
| Mechanism | Role |
|---|---|
| Gateway | Envoy Gateway routes every request through /authz (SecurityPolicy.extAuth). |
| Identity | Humans via Dex (OIDC); agents via DID/VC (did:key subjects + a did:web issuer anchor). |
| Registry | The source of truth for services, agents, models, tools — plus egress allowlists and budgets. |
| Policy | Inline rules then an OPA (Rego) veto; deny-by-default, fail-closed. |
| Observability | Decisions, latency, per-agent token/cost as metrics; DID/VC spans as traces. |
| Audit | Every decision hash-chains to its predecessor — tamper-evident. |
The security invariants behind every decision — deny-by-default, fail-closed on every dependency, identity propagation (not token forwarding), and the tamper-evident authority trail — are specified in the Security model; the Kubernetes enforcement mechanics behind them are deployment detail in Credential-safe action enforcement (Ops) and Self-hosting.
See it live on the operator console — authorization decisions, agent identities, active delegations, and consumption in a single posture view:
Live posture of the PaloNexus authorization service: authorization decisions, agent identities, delegations, and consumption in one view.
Path A — Govern an agent
Build agents; PaloNexus decides what they’re authorized to do.
pip install palonexus, then register → denied → approved → succeed, fully offline.Path B — Run the platform
Operate the control layer the agents are governed by.