What is PermissionOS?
PermissionOS is a zero-trust authorization layer for AI agents. It sits between an AI request and a sensitive real-world action, then applies your rule: ALLOW, ASK a human, or DENY.
AI asks. PermissionOS checks. You decide.
PermissionOS is a human approval and zero-trust control layer for AI agents. It helps stop a hacked, manipulated or mistaken AI from automatically performing sensitive actions simply because the agent already has access.
ALLOW safe actions
ASK you first
DENY dangerous actions
Quick answers
What PermissionOS is, in plain English.
These are the core questions people ask about AI agent security, human approval and zero-trust AI authorization.
What problem does it solve?
AI agents can make mistakes, be manipulated, or become compromised while still holding valid access to email, files, websites, code, data and payment tools. PermissionOS adds an independent action checkpoint.
Why not just tell the AI to ask first?
An instruction inside the AI still relies on that AI to follow it. PermissionOS is designed as a separate enforcement layer, so the agent requests permission rather than deciding whether its own action is acceptable.
Can it help if an AI agent is hacked?
It cannot make hacking impossible. It can help reduce the blast radius by denying dangerous actions or requiring human approval even when a compromised agent requests them.
Can it prevent accidental AI actions?
Yes, when the relevant tool is integrated. Actions such as deleting files, exporting private data, sending important emails or deploying code can be configured to ASK or DENY before execution.
Who is it for?
PermissionOS is for individuals, developers and businesses giving AI agents access to tools where one wrong action could affect money, private information, customers, code, files or production systems.
- AI agent security
- Protecting tool-using AI from misuse, compromised instructions, excessive permissions and unsafe actions.
- Human-in-the-loop approval
- A control where a human must authorize selected actions before the AI is allowed to continue.
- Zero-trust AI authorization
- Treating each sensitive action request as something that must be independently checked instead of trusting the agent by default.
- AI permission policy
- A rule defining which actions an agent may perform automatically, which require approval, and which are prohibited.
PermissionOS · Created by Cornelius Aurelius ·
Why PermissionOS exists
When AI can act, an AI mistake is no longer just a wrong answer.
An agent may be able to send email, delete files, change a website, deploy code, export private information or trigger a payment. PermissionOS is designed to put an independent decision between the AI request and the real action.
⚠ Without PermissionOS
- ✕A compromised agent may still possess valid access to your systems.
- ✕A misunderstood instruction could delete the wrong file or publish the wrong change.
- ✕Prompt injection may try to make the agent leak data or contact someone you never intended.
- ✕An automated mistake can be repeated at machine speed before a human notices.
✓ With PermissionOS
- ✓Routine, low-risk actions can be allowed automatically.
- ✓Sensitive actions can pause and ask you on your phone.
- ✓Dangerous actions can be denied even when the AI requests them.
- ✓The permission decision is enforced outside the AI agent itself.
How it works
Four steps from AI request to controlled action.
The AI requests the action. PermissionOS applies your rule. You only have to get involved when the rule says ASK.
1
AI requests an action
For example: send email, make payment, delete file, publish page or deploy code.
2
PermissionOS checks policy
It checks whether that action should be ALLOW, ASK or DENY.
3
Your phone can ask you
ASK pauses the action and sends an approval request through the current ntfy notification layer.
4
Continue or stop
Approved actions may continue. Denied actions stop. The decision can be logged.
Beginner setup guide
Install both parts on your phone.
PermissionOS is the control app. ntfy is the notification app used by the current public beta. You install PermissionOS from the website, and ntfy from your phone's app store.
The two phone apps
✓
PermissionOS
Your AI permission control centre. Installed from the website as a PWA/home-screen app.
🔔
ntfy
The third-party notification delivery app currently used for instant approval alerts.
Important: PermissionOS is not currently downloaded from Google Play or the Apple App Store. Open PermissionOS in your browser and install/add it to your home screen.
Part 1 — Install PermissionOS
Android / Chrome
Open PermissionOS → Chrome menu ⋮ → Install app or Add to Home screen → Install.
iPhone / Safari
Open PermissionOS in Safari → tap Share → Add to Home Screen → Add.
Part 2 — Install ntfy
Install ntfy, open it once, and allow notifications when your phone asks. ntfy's official documentation lists native Android and iOS apps.
Part 3 — Connect ntfy to PermissionOS
1
Sign in to PermissionOS on your phone.
Use the same PermissionOS account you want to protect.
2
Tap “Enable instant approvals”.
PermissionOS creates or retrieves the private notification topic for your account.
3
Open the subscription in ntfy and subscribe.
Do not publish or share your private topic name.
4
Allow ntfy notifications.
For reliable alerts, make sure your phone has not disabled ntfy notifications or background delivery.
5
Return to PermissionOS and run the instant test.
You should receive a real PermissionOS approval notification. Expand the notification if the APPROVE / DISAPPROVE buttons are collapsed by your phone.
API & connection guide
What is an API key, and where does it go?
A PermissionOS connection key is like a private digital ID card for the AI or website you are protecting. PermissionOS generates it. The protected system stores it privately and uses it when asking PermissionOS for authorization.
🔑
API key in beginner language
Imagine a private members-only entrance. The AI's backend shows its PermissionOS key at the door. PermissionOS checks the key, knows which account and agent the request belongs to, and then evaluates your rules.
Example only:
pos_live_EXAMPLE_ONLY_DO_NOT_USE
pos_live_EXAMPLE_ONLY_DO_NOT_USE
Never share the real key. Do not put it in public HTML or JavaScript, screenshots, GitHub commits, forum posts, emails, or AI chats. Treat it like a password for the connection.
How to connect an AI or website
You normally do this once for each protected integration.
1
Create/register the AI agent in PermissionOS.
Give it a recognisable name, such as “Website Assistant” or “Finance Agent”.
2
Set the ALLOW / ASK / DENY rules.
Decide what that agent is allowed to do before connecting it to real actions.
3
Generate the PermissionOS connection key.
The key begins with pos_live_. Copy it when PermissionOS shows it.
4
Put the key in the protected system's backend secrets.
The key goes in the AI/site server, not into visible frontend code and not back into PermissionOS.
5
Make the backend ask PermissionOS before sensitive actions.
The protected system calls PermissionOS before it sends, spends, deletes, publishes, deploys or exports.
6
Obey PermissionOS's answer.
ALLOW may continue. DENY stops. PENDING means wait for the human decision and check the request status.
Developer example — authorization requestExample key only
POST https://permissionos.hatchable.site/api/agent/authorize
Authorization: Bearer pos_live_EXAMPLE_ONLY
Content-Type: application/json
{
"request_id": "unique-request-123",
"agent_key": "website-assistant",
"action": "email",
"target": "supplier@example.com"
}
Possible result:
ALLOW → continue
DENY → stop
PENDING → wait for phone approval, then check /api/agent/status
🔒 Keep secrets on the server
Your PermissionOS key belongs in backend/server secrets or environment configuration, never public browser code.
🧾 Give every action a unique request ID
Unique IDs help prevent accidental replay and make it easier to trace the exact action that was approved.
⏸ Never treat PENDING as approval
PENDING means the action is paused. Execute only after the final PermissionOS decision becomes ALLOW.
🔁 Rotate a key if exposed
If a key leaks, disable or regenerate it and update the protected backend with the new key.
💳 Do not send raw card details
For payments, use a payment provider's tokens/OAuth. PermissionOS should authorize the action, not store PAN/CVV data.
🔌 Each real service needs an integration
Gmail, Stripe, GitHub, Drive and other tools require their own secure API/OAuth connection. PermissionOS is the authorization layer in front of those actions.
What can it be used for?
Protect actions where one bad AI decision could matter.
The same permission idea can sit in front of many kinds of connected AI tools.
🕵️
Hacked or manipulated agent
Limit what an attacker can make a compromised AI actually do.
🗑️
Files & deletion
Require approval before destructive file or data actions.
💳
Payments
Gate purchases or transfers and apply amount-based policies.
🚀
Publishing & deploys
Keep production changes behind a human checkpoint.
✉️
Let AI draft while requiring approval before sensitive sends.
📤
Data export
Block or review attempts to move private data outside your systems.
💻
GitHub & code
Allow coding work while restricting destructive or production actions.
🌐
Websites & APIs
Require permission before high-impact changes or external API actions.
✓
Real Gmail gating has already been demonstrated.
A real external Gmail action remained paused until PermissionOS recorded an APPROVE / ALLOW decision. That test proved the human gate concept with a genuine external action. Direct service integrations are still being expanded during the beta.
FAQ
Beginner questions, answered clearly.
What is AI agent security?
AI agent security is the practice of protecting autonomous or tool-using AI systems from compromise, excessive permissions, unsafe tool use, accidental actions and unauthorized access to connected systems.
What is zero-trust authorization for AI?
Zero-trust authorization means a sensitive AI action is independently evaluated at the time of the request instead of assuming the AI should be trusted because it already has access to a tool or account.
What is PermissionOS?
A security checkpoint between AI agents and real actions. You decide what can happen automatically, what must ask you first and what must be blocked.
Why would I need it?
You need this kind of control when an AI has tools or credentials that let it actually change things: send messages, spend money, delete information, deploy code, edit websites or access private systems.
Why do I need ntfy as well?
The current PermissionOS public beta uses ntfy as a third-party notification delivery layer for instant phone approval requests. PermissionOS makes the authorization decision; ntfy delivers the phone notification.
Is PermissionOS itself an app-store app?
Not currently. PermissionOS is a progressive web app. Open it in your mobile browser and choose Install app or Add to Home Screen. ntfy is the part you download from Google Play or the Apple App Store.
What is an API key?
It is a private credential that identifies the protected AI or backend to PermissionOS. Think of it like a secret access card used by software.
Where do I paste the PermissionOS API key?
Into the private backend/server secret configuration of the AI, website or integration being protected. You do not paste it into public website code and you do not need to paste it back into PermissionOS.
Can PermissionOS make AI impossible to hack?
No. PermissionOS is designed to reduce the damage a compromised agent can cause by independently restricting the actions it is allowed to perform.
Could it stop accidental deletion?
When the file system is integrated, you can make delete an ASK action requiring approval or a DENY action that is simply blocked.
What happens when PermissionOS says ASK?
The action becomes pending. Your phone can receive an approval request. If you approve, the final decision becomes ALLOW. If you disapprove, the action is denied.
Can I connect Gmail, Stripe, GitHub or Google Drive?
That is the intended model, but each service needs its own secure API or OAuth integration. PermissionOS is the policy and authorization layer that sits in front of the action.
Is it safe to share my referral link?
Yes. Your referral URL is designed to be shared. A pos_live_... connection key is different and must remain private.
Is PermissionOS finished?
PermissionOS is an active free public beta. Core policy, authorization and phone-approval concepts are working while more integrations, first-party notification infrastructure and production hardening continue to be developed.
Free public beta
Powerful AI. Human permission.
Create your account, install PermissionOS on your phone, connect instant approvals and start defining what your AI is allowed to do.