Action-level policy
Control operations, not only tool access. Allow read, deny delete, and conditionally permit transfers.
01 · Permra Scopes
Give every agent a clear boundary.
Define exactly which tools, resources, actions, and conditions an agent may use. Evaluate the whole context before any grant is issued.
agent: finops-agent
allow: transfers.create
when:
amount: "≤ 25000 USD"
recipient: allowlisted
time: business_hours
otherwise: require_approvalPolicy matchedGrant constrained to one transfer
Built for production agents
Control that is precise enough for code and clear enough for people.
Least privilegeIssue the smallest useful grant for the action at hand.
Framework-agnosticKeep policy outside any single model, tool, or agent runtime.
AttributableKnow which agent acted for which user under which policy.
Capabilities
Everything needed to make the boundary operational.
Context-aware constraints
Evaluate user, agent, tenant, session, amount, time, geography, and resource together.
Policy that travels
Keep one policy model across frameworks, tools, models, and deployment environments.
Explainable decisions
Return the policy path, matched conditions, and reason with every allow or deny decision.
Fits your stack
One decision layer. Every agent framework.
Call Permra before a tool invocation, resource operation, or consequential action. Keep your existing identity, model, orchestration, and application stack.
Agent runtime
PermraTool or action
Put Permra in the path
Set the boundary before the first action.
Start with one agent, one consequential action, and one clear policy.