Control AI agent actionsbefore the tool executes.

Put an authorization boundary between every agent and the tools it can call. Verify identity, evaluate policy, require approval, and keep the evidence.

Start free Explore integrations

Authorization API

Put one decision contract in front of every MCP, HTTP, and connected tool call.

Shadow or enforce
Allow, deny, or review
Signed decision receipt

Agent identity

Bind agents to verified principals, delegated users, tasks, and purpose.

Human approvals

Hold sensitive actions and resume the exact request after a decision.

Policy as code

Version rules for tools, resources, arguments, environments, and risk.

Scoped grants

Exchange an approval for short-lived, one-use authority on supported adapters.

Decision evidence

Join the request, policy, reviewer, execution, and signed receipt.

Least privilege

Review observed behavior and tighten access without guessing.

Use one control or all of them. Identity, policy, approval, execution, and evidence work as one boundary.

Bring one authorization contract to the paths you already use

GitHub adapter

MCP servers

HTTP API

Node SDK

Shadow mode

Connected accounts

See and control agent activity
without leaving the dashboard

app.endram.com / policy

DecisionsAuthorization requests

PrincipalToolResourceOutcome

release-botgithub.create_issueplatform/apiReview

support-agenthubspot.read_contactcontact/1829Allow

deploy-agentcloudflare.update_workerproductionDeny

Every attempted action reaches the same boundary.

See the principal, delegation, resource, matched policy, and outcome before execution.

Product preview · illustrative request data

Use Endram with Node.js

Wrap the attempted tool action with one authorization request. Enforce immediately or begin in shadow mode.

Explore API and SDK connections

Node.jsHTTPcURL

import { Endram } from "@endram/node";

const fence = new Endram();

const decision = await fence.authorize({
  principal: "agent:release-bot",
  tool: "github.create_issue",
  resource: "repo:platform/api",
  environment: "production",
});

if (decision.outcome === "allow") {
  await runTool(decision.grant);
}

Start in shadow mode. Enforce when ready.

Compare all plans

Free$0

Observe up to 3 agents and 100,000 decisions each month.

Start workspace

Developer$49/month

Production controls and up to 1 million decisions each month.

See plan details

Team$299/month

More agents, users, volume, evidence retention, and SSO.

See plan details

The boundary, stated plainly.

Does Endram replace authentication?+

No. Authentication proves a user or client identity. Endram uses that identity and its delegated context to decide whether this exact agent may perform this exact action now.

Can we observe before enforcing?+

Yes. Shadow mode records requests and policy outcomes without interrupting production. You can inspect real request shapes before publishing enforcement rules.

Does the agent receive provider credentials?+

Not on the native adapter path. Endram keeps the provider credential server-side and consumes a short-lived, one-use grant for the approved tool and resource.

What can we integrate today?+

Use the HTTP authorization API or Node SDK for any tool path. The product also includes connected-account infrastructure and a native GitHub issue-creation execution adapter.

Observe one agent, then enforce policy