We started BehalfID after running into the same problem while working with increasingly capable AI coding agents. The agents could act — deploy, migrate, rotate a secret, move money — but the controls around what they were actually allowed to do were still too coarse. A key that lets an agent open a pull request usually lets it do far more, and nothing catches the difference until afterwards, in a log nobody reads.

So we built the checkpoint we wanted. BehalfID gives agents enforceable permissions rather than standing credentials: one decision evaluated before the action runs, returned as allow, deny, or approval required, failing closed at the point where you integrate it. Routine work passes without friction. Risk stops and waits for a named person, and the approval becomes part of the audit trail.

It is early, and we would rather say so here than have you find out during a security review. The enforcement loop works end to end today. The gaps are written down on the security page, not buried.

What is enforced

BehalfID enforces where you integrate it — the SDK in your own code path, the CLI's action-time hooks, or the Action Gateway. A denied or approval-required decision means the integrated executor does not run.

What is advisory

Passport links, memory blocks and advisory MCP tools tell an agent what it may do. They inform the model; they do not intercept. An action that skips the enforcement point is not covered, and we say so on every page that mentions them.

What is not certified

No SOC 2 Type I or Type II, no ISO 27001, no HIPAA. Controls hardening is underway and the current posture is documented in full, including the parts that are not finished.

What is still early

No formal external security audit yet. Claude Code's PreToolUse hook fails open on missing config and network timeouts — BehalfID is not universally fail-closed, and we will not describe it that way.

The long versions live on the security model and compliance posture pages, including the limitations list.