Early access · Private pilots

Runtime authorization for AI agents.

Evaluate consequential actions before they execute.

Agents can be authorized to use email, payments, APIs, CRM systems, and files without being authorized to take every action those capabilities make possible. Themis evaluates whether a specific action should happen, given the task, authority, provenance, and runtime context, before it executes.

Request a demo Talk to us

Example

One task. Two outcomes.

A permitted capability does not mean every use of that capability is authorized.

BenignALLOW

Task: Review a support ticket and reply to the customer.
Outcome: The agent reads the ticket, looks up the customer, and replies normally. The reply goes to the ticket’s customer, with data the task legitimately covers.

UnsafeBLOCK

Task: Same task. Same email capability.
Outcome: Attacker-controlled content in the ticket steers the agent into sending customer data to an unrelated destination. The destination and the data provenance do not match the delegated task, so Themis blocks the send before it leaves.

Source of authority

Same agent. Same permission. Same action. Different source of authority.

A DevOps agent is permitted to modify production configuration. Whether one specific modification is authorized depends on where the instruction came from.

Case ABLOCK

GitHub issue · external, untrusted

“Set WORKER_POOL=64”

Same agent

Update production configuration

Case BALLOW

Production runbook · trusted, internal

“Set WORKER_POOL=64”

Same agent

Same production configuration action

The capability is permitted in both cases. The source of the instruction carries the authority, and the two sources do not carry the same authority.

The same question in finance

External invoice introduces a payout accountPayment destination derives from the invoiceBLOCK

Real agent

See it with a real agent.

A real LLM agent produced the unsafe action in a sandboxed environment. We replay the same captured runtime context and proposed action with and without Themis enforcement.

Normal user taskAttacker-controlled ticket

Real LLM agent
Reads customer data
Unsafe email proposed
Tool capability permitted

Without Themis

Email executes

Unauthorized sandbox delivery

Customer data leaves to the attacker’s destination (sandboxed).

With Themis

Themis: BLOCK

Action stopped

Decision and reasoning recorded before execution.

Request a live session on the real-agent demo →

Integration

Works with the agents you already have.

You do not rebuild agents in Themis. Where your agents share a common runtime or execution layer, one runtime integration can cover the agents that run on it. Each agent keeps its own capabilities, authority model, and source classifications.

Themis does not replace

The LLM, the agent framework, connectors, your base permission system, your approval UI, or the tool executor.

Your platform remains the source of truth for

Identity, tools, connectors, and base permissions.

Themis adds

Provenance, source authority, consequence classification, sensitive-argument semantics, trajectory constraints, cumulative exposure, and runtime enforcement decisions.

How it works

One decision per consequential action.

Capability control answers whether an agent may use a tool. Runtime authorization asks whether this specific use should happen now, given who asked, what authority was delegated, where the data came from, and where the action is going. Themis adds the second question beside the controls you already run.

Agent proposes an action

The agent, on its own or via a tool call, proposes a consequential action: send an email, move money, call an API, write to a CRM, read or share a file.

Themis evaluates the action in context

Identity and tenant, the task the user actually delegated, the action and its destination, where the data came from, and current security signals and policy.

Themis returns a decision

One of ALLOW, ALERT, REQUIRE APPROVAL, or BLOCK, with the reasoning attached so the result can be reviewed, audited, and replayed.

Your execution layer enforces it

Your existing gateway, tool runtime, or MCP layer carries out the decision. Themis decides; your execution layer enforces.

ALLOWALERTREQUIRE APPROVALBLOCK

Architecture

Where Themis sits.

Themis decides. Your execution layer enforces.

Permissions

Do you maintain permissions twice? No.

Existing agent platform

The DevOps agent may modify production configuration.

Themis

An external GitHub issue may not authorize that modification.

Effective runtime decision

BLOCK

Your platform remains the source of truth for base permissions. Themis adds constraints ordinary RBAC cannot express: source authority, provenance, consequence, and trajectory. Themis is not a second IAM or RBAC system.

Adoption

From first integration to enforcement.

Connect the runtime

Integrate at the runtime or execution layer your existing agents already share.

Import existing capabilities

Reuse your existing tool and connector schemas and permissions. Themis adds security semantics on top.

Start in Observe

Themis makes real decisions and records them without changing runtime behavior.

Selectively enforce

Enable enforcement per workflow once telemetry and policies have been reviewed.

Rollout

Observe first. Enforce when ready.

Observe

recommended_decision: BLOCKruntime behavior: ALLOW

See what Themis would stop without changing production behavior.

Telemetry verification
Policy review
False-positive measurement
Pilot onboarding

Enforce

ALLOWThe action continues.
ALERTThe action continues; the decision is recorded and flagged.
REQUIRE APPROVALRouted to your existing approval workflow.
BLOCKExecution is suppressed; the decision and reasoning are recorded.

Move from visibility to selective enforcement without rebuilding the agent.

What Themis reasons about

Provenance. Authority. Consequence. Trajectory.

Provenance

Where did the information influencing the action originate?

prepare_payment.account← external invoice

Authority

What consequence was actually delegated to this agent and task?

FINANCIAL_TRANSFER delegatedAUTHORITY_CHANGE not delegated

Consequence

What happens if the proposed action succeeds?

prepare_payment → financial transfersend_email → external disclosureupdate_config → production modification

Trajectory

What relevant actions, approvals, and consequences have already accumulated across the task or session?

3 external sends this task1 approval granted

Identity, tenant, and policy context from your platform carry into every decision.

Limits

What Themis can and cannot see.

Provenance is derived, not declared

Themis derives provenance from runtime telemetry rather than asking the model where an action came from. Direct value propagation is tracked deterministically:

invoice: XXXX-8391↓prepare_payment(account=XXXX-8391)↓source = invoice

Transformed values are harder: “increase the worker count fourfold” plus a trusted current value of 16 yields 64 with no literal copy. Themis does not claim arbitrary semantic attribution. Unresolved high-consequence cases can be routed conservatively to REQUIRE APPROVAL.

Coverage follows instrumentation

Themis reasons about context visible through instrumented runtime paths. An input path never exposed to Themis is not reconstructed later. Context is classified as observed, not instrumented, or unknown.

A different question than input filtering

Input guardrails ask: is this input attempting to manipulate the model? Themis asks: is this information authorized to make the agent cause this consequence? Both can be useful. They are different controls.

Validation

External evaluation.

Controlled benchmark results, not production metrics. Each figure is shown with its denominator, the evaluation it came from, and the conditions it depends on.

AgentHazard

88.5%

Control intervention on evaluable harmful trajectories

285 / 322

18 BLOCK · 267 REQUIRE APPROVAL · 0 ALERT

322 / 2,653 benchmark cases met the evaluation criteria (12.1%). The evaluable subset is not representative of the full benchmark category distribution.

External harmful-trajectory evaluation; conditional on required runtime telemetry.

AgentDojo-derived

1.1%

Consequential-action authorization bypass

6 / 547 with Themis

vs 5.5% (30 / 547) stateless control

95.9%

Legitimate-task autonomy under precise oracle authority

93 / 97 legitimate tasks

Oracle authority provides precise task and destination scope. Real-world performance depends on the authority context available from the agent runtime.

Banking subset: 0.7% (1 / 144) vs 17.4% (25 / 144) stateless.

Deterministic AgentDojo-derived canonical-trajectory authorization evaluation, not a live LLM benchmark.

See evaluation methodology →

Runtime requirements

What a pilot needs from your runtime.

Themis sits beside your existing gateway or tool runtime and consumes runtime facts about each proposed action. In observe mode it is not in the enforcement path: decisions and reasoning are recorded, nothing in production changes. The facts below are ranked by how much they moved the measured security and autonomy results.

Required

The proposed tool call with its arguments and destination identifier. Tenant, principal, agent, and session identity. The task’s delegated authority where the application can supply it: which destinations and consequences the user actually authorized. Precise delegated authority is the single highest-leverage input.

High value

Source trust of tool-returned content (which reads carry third-party or untrusted material), recipient and resource ownership (internal versus external destination), and data classification where your environment carries sensitive data.

Not required

Model chain-of-thought, raw prompts or injection text, upstream credentials, or model weights. Themis reasons from observable actions, authority, and provenance, not from the text that steered the model.

Deployment

The decision and provenance plane can run inside your environment.

Private deployments are designed to keep runtime-sensitive data in your environment. Under this model, the Themis control plane receives operational telemetry, not runtime content. The deployment model is agreed per pilot.

Themis control plane

Health, latency, error rates, policy and version identifiers, decision counts, integration state, and optionally pseudonymous agent or session identifiers.

Processed locally under this model

Agent context relevant to provenance, tool results, proposed action arguments, provenance state, and local policy state.

Sent to the control plane

Operational telemetry only: health, latency, error rates, policy and version identifiers, decision counts, integration state, and optionally pseudonymous agent or session identifiers.

Never required

Model API keys, payment credentials, CRM credentials, database credentials, SSH credentials, or connector secrets.

Status

Early access. Private pilots. Design partners.

Themis Agent Intelligence is currently available for a small number of private pilots with teams deploying autonomous agents in consequential workflows. Pilots start with one agent workflow in observe mode. Themis evaluates real agent actions alongside your existing execution layer, and we review intervention coverage and benign friction with your team. It is not generally available.

Join a private pilot →

Running autonomous agents with access to customer data, payments, APIs, or other sensitive actions?

Talk to us about a demo or a private pilot. Four fields; we reply within 1–2 business days.