hallpass
An authorization-checking service designed for AI agents that queries an authoritative system for the caller's actual permissions before write operations are executed. It implements a fail-closed security policy to prevent agents from performing operations that exceed their authorized scope.
Timeline (last 90 days)
hallpass is an independent authorization proxy microservice that, before executing write operations, queries an authoritative system to check whether the caller has permission, returning one of three results: allow, deny, or unknown.
hallpass adopts a fail-closed policy, where when the result is unknown (including situations that cannot be evaluated such as timeouts and rate limiting), the tool does not execute the operation.
hallpass covers the write paths of a total of 21 systems including GitHub, Kubernetes, Argo CD, Jira, and AWS.
hallpass is compatible with mainstream Agent frameworks such as Strands, LangChain, LangGraph, and Claude Agent SDK, and can also run as an MCP server.
hallpass is a single binary file released under the Apache 2.0 open-source license.
Integrating hallpass on the Agent side requires only a decorator implementation, where the user identity comes from the session (current_user) rather than the model, and the tool schema contains no user field.
All Facts (6)
hallpass is an independent authorization proxy microservice that, before executing write operations, queries an authoritative system to check whether the caller has permission, returning one of three results: allow, deny, or unknown.
50%Unverifiedhallpass adopts a fail-closed policy, where when the result is unknown (including situations that cannot be evaluated such as timeouts and rate limiting), the tool does not execute the operation.
50%Unverifiedhallpass covers the write paths of a total of 21 systems including GitHub, Kubernetes, Argo CD, Jira, and AWS.
50%Unverifiedhallpass is compatible with mainstream Agent frameworks such as Strands, LangChain, LangGraph, and Claude Agent SDK, and can also run as an MCP server.
50%Unverifiedhallpass is a single binary file released under the Apache 2.0 open-source license.
50%UnverifiedIntegrating hallpass on the Agent side requires only a decorator implementation, where the user identity comes from the session (current_user) rather than the model, and the tool schema contains no user field.
50%