primarypath

Open source, Apache-2.0Self-hostedNo phone-home

Let AI agents act. Keep the proof.

Primary Path pauses an agent's consequential actions until a person with the right role approves them, with the agent's full reasoning in front of them. Every run lands in a hash-chained, signed log that your auditor checks on their own machine, without trusting you or us.

Run it in two commands Read the docs

A real audit log, checked by your browser just now

bundle.json

Recomputing every hash…

    Exported from the two demos below. Rewrite the refund's amount in its approval request, the way someone with database access would, and watch the chain give it away.

    The problem

    An agent that acts can be wrong once and cost you the quarter.

    Refunds, rollbacks, record exports: most teams guard them in one of three ways, and each one breaks in a predictable place.

    • Let it act, watch the logs

      Works until the one refund that was fraud, or the rollback of the deploy that was fine. The log tells you afterwards. It can't stop anything.

    • Ask in chat

      "OK to roll back checkout?" gets a thumbs-up from someone who saw one line, not the agent's evidence. Six months later nobody can prove who approved what.

    • Build an approval step per agent

      Every team writes its own pause, queue and audit table. The table is rows in a database the operator controls: to an auditor, a promise rather than proof.

    How it works

    One control between the agent and the action.

    1. 01

      Propose

      The agent sends the action it wants to take: tool, exact arguments, and its reasoning.

    2. 02

      Pause

      The run waits, durably. The agent or the server can restart and the case is still there.

    3. 03

      Decide

      A person with the right role approves, rejects with a reason, or sends it back, in the inbox, Slack or Teams.

    4. 04

      Resume

      The agent gets the decision. An approval carries a signed, single-use grant bound to that exact action.

    5. 05

      Prove

      Every step is a hash-chained, signed record. Anyone can verify an export offline, and tampering names the record.

    It doesn't run your agent and doesn't care what it is written in. Any agent that can make two HTTP calls can be governed: one to propose, one to learn the decision.

    For LangGraph, the OpenAI Agents SDK, the Claude Agent SDK and drangue there is a package that uses the framework's own pause. For tools over MCP, a gateway sits in between and the agent needs no changes. Integrations

    # 1. propose: the run pauses
POST /api/approvals
{"run_id": "run-42", "call_id": "step-7",
 "tool": "send_wire",
 "arguments": {"amount": 90000, "to": "ACME GmbH"},
 "reasoning": "Invoice INV-311 matches the PO."}

# 2. poll until a person decides
GET /api/approvals/run-42:step-7
{"status": "granted", "reviewer": "m.okafor", ...}

    See it run

    Two agents, two decisions, one verifiable record.

    The Primary Path inbox: a pending €840 refund opens with the agent's reasoning recommending denial; the reviewer rejects it with a reason; the Audit page verifies the chain in the browser, then a tamper drill reports the chain broken at record 9.

    The refund that should not be paid

    A support agent gets a claim for an €840 espresso machine that "never arrived". It was signed for at the door, and the account is 22 days old. The agent's small-refund tool refuses anything over €100 in code, so it escalates. The reviewer rejects it with a reason, and nothing is paid.

    pip install primarypath-demos
primarypath-demo refunds
    The inbox receives a pending rollback of the checkout service to v1.8.1, with the agent's evidence: a 42% error rate, database pool exhaustion, and a deploy seven minutes before. The on-call lead approves; the case shows an execution grant issued; the run timeline lists each step of the investigation.

    The rollback that should run once

    An on-call agent works an incident: error rate, logs, recent deploys, the runbook. It can investigate alone, but rolling back production waits for the on-call lead, who sees the whole investigation and approves. The approval comes with a signed grant for that exact version.

    primarypath-demo sre

    Use cases

    Where it earns its keep.

    Money movement

    Refunds, payouts, credits and wires above a limit: two approvers for large amounts, approval limited to your finance group's IdP group, and a rejected payment that provably never ran.

    read →

    Production changes

    Rollbacks, deploys, scaling and deletes: the diagnosis, the approval and the grant in one signed chain, with routine actions earning autonomy from their track record.

    read →

    Access to regulated data

    Exports, disclosures and access grants: who approved each one, of what, to whom and why, in a record nobody can edit without the chain showing it.

    read →

    Run it

    Two commands to a working inbox.

    You need Docker. The compose file pins the signed image by digest and starts Postgres beside it, on this machine only.

    Everything else: Helm, the Python and TypeScript packages, and how to verify what you download.

    curl -fsSLO https://github.com/om-er/primarypath-releases/releases/latest/download/docker-compose.yml
docker compose up -d --wait
# open http://127.0.0.1:8123
    python3 -m venv demo && . demo/bin/activate
pip install primarypath-demos
primarypath-demo refunds

    On Apple Silicon, run the stack under amd64 emulation: Install has the one extra flag.

    Built to be checked

    Trust it because you can verify it.

    Runs in your network
    One container and your Postgres. Case data goes nowhere else unless you route it to your own Slack, Teams or SIEM.
    No phone-home
    No telemetry, no license server, no update check. The test suite runs with outbound network blocked.
    Verifiable offline
    primarypath-verify re-proves an export on an air-gapped machine against a key you pinned.
    Signed releases
    Image, chart, packages and compose files are signed with Sigstore; check them before you run them.
    Honest about its limits
    An agent holding its own credentials can act without asking. The threat model says so, and says what to do about it.
    Free, Apache-2.0
    No tiers and no license keys. Report security issues privately.