A Reference Architecture Where Agents Can Propose Actions But Are Structurally Unable to Authorize Them

GitHub·medium signalXBlueskyLinkedInCopy link

`decionis/agent-safe-pipeline` (269 stars, created 2026-08-13, Apache-2.0) splits agent action into four enforced stages: immutable intent capture, an independent policy verdict of ALLOW/ESCALATE/BLOCK, verified human approval, and a SafeExecutor that will only consume a single-use grant bound to that specific intent. The design point is that the agent never holds the authorization capability at any moment, so prompt injection cannot escalate it — a stronger property than the confirm-dialog pattern most agent frameworks ship. Topics include policy-as-code, MCP and human-in-the-loop; it is a reference architecture, not a runtime, so expect to port the pattern rather than install it.