Every one of these is a real mechanism, not a mockup.
From a support copilot that can't leak billing data, to one switch that halts every agent in the org — each scenario below runs on the exact same authorization path and signed receipt every governed call gets. Nothing here is illustrated; it's what the product already does.
A support copilot that can see billing data but never repeats it wholesale
Your support agent pulls a customer's plan, invoices, and usage history to answer a ticket. It should never be able to paste that data into a public help-center article or a channel outside the support team.
Agent Passport's data_scope field locks what class of data an agent is allowed to touch, enforced before the model call — not caught after the fact by a DLP scanner reading the output.
An agent that drafts vendor payments, capped at what a human actually approved
An AP automation agent drafts vendor payment approvals from invoices. One malformed prompt, or a bad upstream response, could authorize a run for far more than anyone intended.
A per-agent cost cap is reserved and enforced pre-execution — atomically, before the call goes out — not tallied afterward once the spend already happened.
An internal ops agent with real shell access — and a hard line it can't cross
A DevOps copilot can restart services, roll back deploys, and read logs. It should never be able to call drop_database or rm_production_bucket, no matter what a poisoned prompt tries to make it output.
Action-Scope Passports allow-list exactly which tool/function names an agent's LLM may request — enforced on the response itself, before your code ever executes the call.
An orchestrator that can only hand its workers a narrower slice of itself
A research orchestrator spins up worker agents at runtime to search, summarize, and draft. A compromised or buggy worker should never end up with more permission than the orchestrator that spawned it.
Delegation Grants are capability-based: a worker's effective permissions in a chain can never exceed what was actually, provably handed to it — checked at mint time and independently re-verified, hop by hop.
A clinical intake assistant that stays inside its region and its own evidence
A patient intake assistant handles PHI and needs to prove — continuously, not once a year for an auditor — that every call actually meets HIPAA's real requirements.
A living, Ed25519-signed compliance attestation is generated from the real call log, not filled in by hand once and forgotten — paired with a region_scope label enforced alongside allowed providers.
Letting an outside auditor verify a decision without handing them your dashboard
A lending underwriting agent's decisions get reviewed on a fixed engagement by an external auditor who was never a Permisyn user and never will be.
A revocable, expiring auditor/regulator link exposes only compliance posture, the AI Bill of Materials, and receipt metadata — never prompt content, never your full dashboard.
Twelve engineers, one company key, zero provider keys pasted into a laptop
Instead of issuing individual provider keys — or one shared key nobody's accountable for — the whole team uses one governed lane, with every call still individually attributable.
A Shareable Team Header Profile locks team, purpose, budget, and passport server-side; every teammate's snippet only ever fills in their own email.
Knowing exactly which team burned the budget on a content-generation spree
Marketing, growth, and product each run their own AI-assisted tools against the same company account. When the monthly bill spikes, someone needs a real answer in under a minute — not a guess.
Every call carries a team header, rolled up by user, team, and agent on one usage page — real recorded spend, not an estimate reconstructed from a provider invoice.
One switch, for when something's gone wrong and you don't yet know what
A dependency got compromised, or an agent started behaving strangely at 2am. You don't have time to hunt down which of forty agents is affected — every AI call in the org needs to stop, right now.
Freeze-all-AI is an org-wide circuit breaker, checked first in the pre-flight chain, broadest scope before team, user, or per-agent kill — every blocked call still gets a signed denial receipt.
A contractor's agent that revokes itself the day the contract ends
A short-term contractor's agent needs real access for six weeks, and zero access on week seven — without anyone having to remember to go turn it off.
passport_expires_at is checked at call time, no cron job required — the passport self-revokes, and every call after that gets a distinct, auditable expiry decision.
Catching the agent nobody told IT about, the moment it makes its first call
Someone on the team wires up a new AI script against the shared key without opening a ticket. By the time it shows up in a spreadsheet review, it's been running unmanaged for months.
The first call from a name Permisyn has never seen fires a notification immediately, and every tool it declares is passively logged — so allow-listing it later never means retyping code.
Proving, to someone who doesn't trust you, that a call was really blocked
A denied call becomes a dispute months later. Did the system actually stop it, or did someone just say so? A log entry that Permisyn itself could have edited isn't proof of anything.
Every decision — allowed or blocked — is Ed25519-signed with your own org's key and independently verifiable at a public URL, with no Permisyn secret required to check it.
An internal tool that's only ever allowed to speak to one exact model
A cost-sensitive internal script was scoped to a cheap model at review time. Nothing stops a future code change — or a compromised dependency — from quietly pointing it at a more expensive, more capable model instead.
Agent Passport's allowed_models/allowed_providers are enforced pre-upstream on every call — a model or provider outside the list is rejected before it ever reaches the network, not caught on next month's invoice.
Pulling the plug on one misbehaving agent without touching the other 39
One agent starts looping, spamming an API, or doing something nobody asked for. Freezing the whole org over one bad actor would stop every legitimate call along with it.
The kill switch revokes exactly one agent, instantly, checked before every upstream call — every other agent in the fleet keeps running untouched.
Halting one team's AI access during an internal investigation
Legal opens an internal review involving the sales team. Every sales-attributed AI call needs to stop today — but product, support, and engineering shouldn't even notice.
Team-level halt pauses every call carrying that team's header, independent of the org-wide freeze switch or any single agent's kill state.
Revoking one departing employee's AI access the moment offboarding starts
Someone's leaving the company today. Their laptop, their badge, and their AI access should all stop working at the same time — not whenever someone remembers to also update a third system.
User-level halt blocks every call carrying that person's accountable identity the moment IT flips the switch — no agent has to be individually found and killed.
Proving a four-hop agent pipeline never got tampered with in the middle
A document passes through an extraction agent, a summarizer, a translator, and a publisher. If hop three's output doesn't match what hop four claims it received, something in that pipeline lied.
Each hop's input hash is checked against the previous hop's signed output hash — an unbroken, independently verifiable chain, not four separate logs you have to trust line up.
Catching an agent that's quietly started behaving differently
An agent's outputs slowly drift — different tool-call patterns, a shift in token volume, language that doesn't match its usual baseline. Nobody files a ticket for 'feels a bit off.'
Online statistical and semantic fingerprinting scores every run against the agent's own baseline and flags a real anomaly on the receipt itself — advisory by default, visible fleet-wide.
Rotating a leaked provider key without touching a single line of app code
A provider key leaked in a public repo. Every app and script that used it directly now needs a code change and a redeploy — under pressure, at the worst possible time.
Provider keys live encrypted in the org vault; callers send only their Permisyn key. Rotating the real upstream key happens once, centrally — nothing downstream has to change.
Proving not just that a call was authorized, but exactly what came back
A dispute isn't always about whether a call was allowed — sometimes it's about what the model actually said. A receipt that only proves authorization can't settle that argument.
Opt-in output attestation hashes the real completion and binds it into the same signed receipt — proof of exactly what came back, not just that the call was permitted.
A live, verifiable trust badge on your own site — not a static compliance PDF
A prospective customer's security team wants proof your AI usage is governed — today, not whenever your compliance PDF was last updated by hand.
A public, Ed25519-signed trust badge and AI Bill of Materials are generated from the real call log on every request — always current, checkable by anyone, no login required.
Onboarding a new hire's AI access in two clicks, with a verified identity
A new teammate needs AI access on day one. Handing them a raw snippet to hand-edit invites a typo'd email that quietly misattributes every call they ever make.
A one-click onboarding link resolves the team's locked profile and only unlocks the finished snippet after the teammate's own email is confirmed — never a typed-in guess.
Routing to your own self-hosted model, without opening an SSRF hole
A team wants to point Permisyn at a self-hosted or fine-tuned model behind a custom URL. A naively-implemented custom-upstream feature is exactly the kind of thing that ends up quietly reachable to localhost or an internal metadata endpoint.
Custom upstream URLs are validated for scheme, embedded credentials, and DNS-resolved private/internal IP ranges before a single byte is forwarded — the same check a real pentest would run.
Withholding an unauthorized tool call on a stream that was never buffered
Most tool-call safety checks only work on a single, complete response — which is useless the moment a caller switches to streaming for a faster UI.
A tool call names itself in its first SSE frame, and the name is the whole question, so Block mode holds just those frames, checks the name, and drops them if the passport refuses. Your code never receives the instruction. Text the model already streamed keeps flowing untouched, because it is not a tool call and none of it is ours to edit. The provider has already been paid either way — that is the difference between this and Prevent mode, which refuses a declared tool before the call leaves at all.
See your own agent produce a receipt like this.
No sales call required to find out if this fits — start free, point your existing client at Permisyn, and watch the first decision get signed.