your agent never sees the key

/ Open source · MIT

Agents call your APIs through waterlock with a short-lived token. It holds the real keys, checks every call against rules you write, and forwards only what you allow.

Read the docs

/ How it works

  1. 01

    The agent gets a token

    A short-lived, signed session token for one provider. No API key ever reaches the agent.

    Learn more
  2. 02

    You write the rules

    Rules in TypeScript decide what is allowed, default deny. Rules in natural language, answered by your model, can only take away.

    Learn more
  3. 03

    The gateway holds the key

    The real credential is added on the way out, after the call is allowed. Anything else gets a 403 with the reason.

    Learn more

/ The rules

Rules in code, or in natural language

Reading, creating and updating issues are allowed. Moving one to another team is denied in TypeScript, and billing details are kept out with one sentence.

policy: [
  { when: (r) => r.action.startsWith("linear.query.") },
  { when: (r) => r.action === "linear.mutation.issueCreate" },
  { when: (r) => r.action === "linear.mutation.issueUpdate" },
  {
    when: (r) =>
      r.action === "linear.mutation.issueUpdate" &&
      r.params.input.teamId !== undefined &&
      r.params.input.teamId !== AGENTS_TEAM,
    action: "deny",
    reason: "Issues can't be moved to another team.",
  },
  {
    when: "The issue contains billing or payment information",
    action: "deny",
  },
],

/ On a real Linear workspace

Two allowed, two blocked

An AI SDK agent files an issue and raises its priority. Moving it is blocked by a TypeScript rule; a refund with a card number, by a natural-language rule.

/ Providers