Connect your agent.
The planned hooks and SDKs add a permission check before a supported tool call. Your agent runs in your environment.
Agent→Nodrail→Tool
HEADLESS AI GOVERNANCE
Permissions and approvals for AI agents.
Agents move. You decide.
We’re building Nodrail to add scoped permissions, human approvals and decision logs to the agents you already run. Your team keeps its runtime and credentials.
Built for developers and small teams.
Your agents.
A shared permission layer.
Nodrail is a headless permissions and approvals layer in development. The planned hooks and SDKs connect permission checks to your existing tools, while your team keeps execution and provider credentials.
01 / HOW IT WORKS
How AI agent permissions and approvals work
A permission check before the tool call.
A clear decision about what happens next.
Review new permissions.
Without a matching permission, the covered action stays paused. Review its parameters, approve once, create a scoped rule or deny it.
New permission detected ↗
Apply your rules.
A valid rule can allow matching requests automatically. Each covered decision is recorded, and the rule can be revoked.
repo.readAllowed by rule
02 / PERMISSIONS YOU CAN DEFINE
Set permissions for each agent
Define the agent, tool, action and resources a rule applies to. Keep routine work moving within those conditions.
Pause unknown permissions.
A request without a matching permission needs review before the covered tool call can proceed.
Approve once or create a rule.
A one-time approval applies to the exact action reviewed. A standing rule applies to future requests only within its explicit scope.
Revoke permissions when plans change.
Remove a standing permission when it is no longer needed. Revocation applies at the next online permission check; it does not undo completed actions.
Understand the decision trail.
Bring the agent, requested action, policy and approval together. Distinguish what was authorized from the execution result reported by your agent.
03 / HUMAN APPROVALS
Review agent actions before they run
Review the agent, action and parameters in one request. Web approvals are planned for the first release, with Slack and mobile approvals on the roadmap.
Web app Planned for first releaseSlack PlannedMobile Planned
ILLUSTRATIVE REQUESTA release needs your approval.
release-agent wants to publish a release
in acme/website.
- Action
- release.create
- Environment
- production
COMMON QUESTIONS
Questions about AI agent permissions
What is Nodrail?
Nodrail is a headless permissions and human approvals layer in development for AI agents. It is designed to check supported tool calls against scoped rules and record the resulting decisions.
Does Nodrail run my agents or store their tool credentials?
Your team runs its agents and keeps the credentials used to access external tools. The planned hooks and SDKs connect permission checks to your existing environment.
What happens when a permission is unknown or the service is unavailable?
The intended default is to block covered tool calls without valid authorization. An unknown permission creates a review request. An unavailable service, timeout or invalid response must not silently authorize the call; the precise behavior will be documented for each supported integration.
Will I need to approve the same action every time?
A scoped standing rule can allow matching requests automatically for a specific agent, action and resource. Each covered call is still checked. A one-time approval is limited to the exact action reviewed and does not authorize future requests.
Can hooks and SDKs prevent every action an agent might take?
They can govern calls that pass through an enforced integration point. They do not, by themselves, block alternative routes, direct credentials or changes to the integration. Stronger guarantees require isolation and control over those execution paths.
Does an approval prove the action succeeded?
An approval records authorization. It does not prove that the tool ran or that its result was correct. Nodrail is being designed to distinguish permission decisions from execution results reported by the client.
What can I use today, and which integrations are supported?
Nodrail is in development. The first supported runtimes and integration instructions will be published when they have been tested. Join the waitlist for early-access updates.
Will Nodrail be open source?
We plan to publish the integration hooks and SDKs as open source. The repository, license and release scope will be announced with the first usable integration.
EARLY ACCESS
Join the Nodrail waitlist
Building an agent that calls tools?
Help shape its permission and approval workflow.
Early-access invitations and product updates. Unsubscribe at any time.