Skip to content

Private beta · Source available

Agents get access. You keep control.

PassControl gives every AI agent its own identity, scope and budget. Each model call is checked before PassControl uses your provider key server-side.

Request beta accessRun the live demo Inspect the source

Cloud access is invite-only. Self-hosting is available now.

governed call
allowed
Agentresearch-assistantopenai / gpt-5
  1. 01Identity verified
  2. 02Scope allowed
  3. 03Budget reserved
  4. 04Provider call dispatched
  5. 05Receipt returned
provider keyserver-side only

Provider keys stay out of agent environments.

Suspend one agent without rotating shared keys.

Allowed calls return a verifiable receipt.

Live control-path demo

Test the boundary.

Send a call through PassControl's real identity, scope, budget and kill-switch path. Then block the agent and try again.

passcontrol / control path
Live boundary
Demo tenant kill switchACCEPTING CALLSDemo tenant accepting requests

Run once. Block the tenant. Run the same call again.

Gateway resultstandby
Watch control happen.Every signal below comes from the call you just made.
demo agentPassControldemo providerresult
identity ·scope ·budget ·kill ·
response

Ready. Run a call to see the gate decide.

This demo does not contact a paid model or access a provider key. The control decisions are real; the model response is simulated.

One boundary per agent

What happens before the provider sees a call.

01

Identify

PassControl resolves the individual agent instead of trusting a shared provider key.

02

Decide

Kill state, suspension, provider and model scope, live policy, rate limit and budget are checked.

03

Dispatch

If allowed, PassControl uses the provider credential server-side and returns the result with a signed receipt.

A blocked call never reaches the provider.

For builders Change the model API base URL and give the agent a scoped PassControl credential.

For operators Limit, suspend or investigate one agent without disrupting the rest of the fleet.

Choose the operating model

Use our Cloud. Or run the same core yourself.

Hosted

PassControl Cloud

Start without operating the gateway. PassControl Cloud stores provider credentials server-side and gives each agent its own controlled access.

Request beta access
Your infrastructure

Run it yourself

Inspect the source and run PassControl in infrastructure you control.

npm install -g passcontrol
passcontrol setup
View source Read self-hosting guide

Straight answers

Before you put it in the path.

Where does my provider key live?

In PassControl Cloud it is stored server-side and fetched only after a call passes the gate. In a self-hosted deployment it remains in infrastructure you operate. The agent does not receive it.

Does my agent need a new SDK?

Usually not. Compatible tools use a PassControl base URL and scoped agent credential. Passport authentication remains available when stronger cryptographic identity is needed.

Can I inspect or run PassControl myself?

Yes. The core is source-available under BSL 1.1 and includes a self-hosted deployment path.

Start with one agent

Put one real agent behind PassControl.

Early and not yet independently audited. Start with a non-critical provider key.