Decision Lab
See BehalfID gate coding-agent actions before they run.
Choose a coding-agent action, run it through a permission passport, and see whether BehalfID allows it, blocks it, or pauses for your approval.
Claude Code
Attempts a production deploy
Agent request
- agent
- Claude Code
- action
- deploy_production
- vendor
- vercel.com
- resource
- production
Matching ruledeploy_production on vercel.com requires approval
A deploy permission exists, but production deploys pause for human approval before execution.
DecisionNeeds approval
Waiting for approval
The deploy pauses until a human approves it.
Execution
No — the tool did not run.
Audit log
Approval-required decision logged; nothing runs yet. verification.denied
What this proves
Prevents unsafe actions
Tools do not run unless the agent has permission.
Preserves useful automation
Safe actions can proceed without constant user interruption.
Creates an audit trail
Every allowed, blocked, or approval-required action is recorded.
Add the decision point.
The decision above is a real policy decision — the same engine that powers production BehalfID. No external agent action is executed; only the permission check runs.