Autonomy for your agents. Authority for your team.
Where your AI spend is going, who's cleared to spend it, and the calls big enough to need your sign-off — in one place, above whatever gateway your engineers run. Every decision on a signed record.
Your gateway routes the calls. Sanction is where you answer for them.
LiteLLM, Bedrock, Vercel — let them route, cache, and log. Sanction sits above whatever you run: the one place the people accountable for the spend can see it, set the budget, and sign off on the calls that cross the line.
The monthly number
Where AI spend went this month — by team, by provider — and whether you're on budget. The one figure that rolls up across every agent, in every division.
Who can do what
Which agents are cleared for which actions, the line where a human takes over, and a signed record of every call. Set the policy once; it holds across providers.
My team's usage
Your department's agent spend and budget at a glance — no ticket to engineering to find out what your team's AI actually costs this month.
Agent Wallet
Budgets and policy on every spend and provisioning action. Auto-approve under threshold, escalate over it, deny what's blocked.
Credential Vault
AES-256-GCM at rest under a rotating KMS-wrapped key, tenant-isolated at the database. Scoped 15-minute execution tokens gate every injection.
Clearance Levels
A 1–5 clearance system. Agents only ever touch what they're explicitly cleared for. Fail-closed by default.
Every call comes back one of three ways.
Under the threshold, allowed category. The agent proceeds; the spend is logged.
Over your line. The request pauses and waits for a human — approval mints a one-use grant.
Blocked category or over the hard cap. It never reaches the merchant.
Three calls. Governed agent.
Register an agent, set a policy, authorize in real time. Real REST, real MCP — no SDK lock-in, nothing to babysit.
Read the docs →-H "x-api-key: pxy_••••" \
-d '{ "action": "purchase",
"amount_usd": 12.50 }'
# → { "status": "approved" }
Built like the company you're trusting it to be.
Not ready to wire up an agent?
Get launch updates and early access as we ship. One email when it matters — no spam.