Authorize · Protect · Govern
SANCTION
Agent Access Key
PXY · •••• · •••• · AGNT
Clearance ◆ 5 · Valid Thru ∞
Cardholder
AUTONOMOUS AGENT
Don't give your agent your credit card. Give it a Sanction key.
Track and cap what every agent spends, and approve, gate, or deny each action before the money moves or a secret is used. One key governs spend and access.
MCP · AWS Bedrock Action Groups · REST
Authorize
Spend authorization with policy enforcement. Auto-approve under threshold, escalate over it, deny what's blocked. Daily and monthly budgets per agent.
Protect
AES-256-GCM encrypted credentials at rest. Scoped execution JWTs with a 15-minute TTL gate every injection. Nothing leaves the vault unlogged.
Govern
A 1–5 clearance system with industry-specific domain authorization. Agents only ever touch what they're explicitly cleared for.
Sanction sits between your agent and the world. You set the rules once; it enforces them on every call — and keeps a receipt.
Create a wallet and issue a scoped pxy_ API key for each agent. The key is its identity — every call it makes is attributable.
POST /v1/agentsDefine the rules once: daily and per-transaction budgets, auto-approve and escalation thresholds, allowed and blocked categories, clearance level.
POST /v1/walletsBefore the agent spends, it calls /authorize. Sanction returns approve, escalate, or deny in milliseconds — and logs every decision for audit.
POST /v1/authorizeThe decision engine
Every authorize call returns one of three outcomes:
Under the threshold and in an allowed category. The agent proceeds; the spend is logged.
Over your escalation limit. The request pauses and waits for a human to approve or reject.
Blocked category or over the hard cap. The transaction never reaches the merchant.
curl -X POST https://getsanction.vercel.app/api/v1/authorize \
-H "x-api-key: pxy_••••" \
-H "content-type: application/json" \
-d '{
"merchant": "openai",
"amount_usd": 12.50,
"category": "services"
}'
# → { "decision": "approved", "remaining_daily_usd": 37.50 }Coding & research agents
An autonomous coding agent works your backlog overnight — calling Claude, hitting APIs, spinning up sandboxes. Costs compound while you sleep.
With Sanction
Procurement & ops agents
An ops agent renews SaaS, pays contractors, and buys data. You want it autonomous for the routine and gated for the rest.
With Sanction
Sanction is provider-agnostic. Meter spend across model providers, gate payment rails, and vault credentials for the tools your agents already use.
+ any REST API — via MCP, AWS Bedrock Action Groups, or direct calls.
Start free. Scale when your fleet does.
For a single agent finding its feet.
For builders running real agents.
For fleets that need governance.
For regulated, high-volume deployments.