Start free. Upgrade when you enforce in production.
Limits below come from current production entitlements. Free and Pro are self-serve — no sales call. Higher tiers add volume, retention, and organisational controls — the policy engine is the same.
Free — solo builders
For solo builders evaluating enforcement against real agent traffic.
Start free- 3 agents
- 10,000 verifications / month
- 7-day activity retention
- Managed profiles & pause approvals
- Community support
Pro — small eng teams
Most popular$20/mo — less than the cost of one avoided production incident.
For small teams enforcing permissions, webhooks and approvals in production.
Start buildingFail-closed at the integration point. TLS everywhere, keys stored as hashes, we never sell or train on your data. How enforcement and data handling work.
- 50 agents
- 250,000 verifications / month
- 90-day activity retention
- Webhooks & workspace SSO controls
- 25 billable seats
- Email support
Enterprise — security-reviewed orgs
For organisations that need custom retention, procurement and security review.
Contact sales- Unlimited agents & verifications
- Custom retention (contract)
- Advanced audit exports
- Named support engagement
- Security review & rollout help
Running a security review? The security model and current compliance posture are documented, including what is and isn't certified today.
Compare plans
- Free
- 3
- Pro
- 50
- Enterprise
- Unlimited
- Free
- 10,000
- Pro
- 250,000
- Enterprise
- Committed
- Free
- Not included
- Pro
- Included
- Enterprise
- Included
- Free
- Included
- Pro
- Included
- Enterprise
- Included
- Free
- 7 days
- Pro
- 90 days
- Enterprise
- Custom / up to 365 days
- Free
- Not included
- Pro
- Included
- Enterprise
- Included
- Free
- Not included
- Pro
- Not included
- Enterprise
- Included
- Free
- Community
- Pro
- Enterprise
- Named engagement
The same API on every plan.
Price changes volume, retention and organisational controls. It does not change the policy engine, the decision semantics, or which endpoints you can call — there is no enforcement feature behind a sales call.
- One call to integrate
- POST /api/verify with an agent, an action and a resource. It answers allowed, denied or approval required before your code performs the action.
- Ways in
- TypeScript SDK, CLI with action-time hooks for coding agents, MCP server, Action Gateway, or plain HTTP from any language.
- Request rate
- 60 requests per minute per API key, on every plan including Free. Monthly verification volume is what the plan changes.
- Included volume
- 10,000 verifications a month on Free, 250,000 on Pro, committed volume on Enterprise.
- Keys and agents
- Each agent gets its own key, stored as a hash. Free covers 3 agents, Pro 50.
- Reading decisions back
- Decision logs carry the outcome, the policy path, and who decided. Retained 7 days on Free and 90 days on Pro; webhooks stream them out on Pro and above.
import { behalf } from "@behalfid/sdk";
const decision = await behalf.verify({
agent: "cursor-agent",
action: "deploy_service",
resource: "payments-api",
});
if (decision.allowed) await deploy();Every call returns one of three outcomes, and a denied or approval-required decision means the integrated executor does not run. That is the whole contract — try it against the free tier before you talk to anyone.
Start free with the API