Permission_OS

Inspiration

As AI agents become more powerful, they can perform tasks that involve reading data, modifying records, and accessing sensitive information. We realized that simply trusting an AI agent to make the right decision is not always enough. This inspired us to build PermissionOS, a project that adds a human approval layer between AI agents and the actions they want to perform.

What it does

PermissionOS is a self-hosted MCP gateway that checks every tool request before it reaches the actual service. Based on predefined policies, a request can be allowed immediately, held for human approval, or denied completely.

Our demo covers three real-world-style scenarios: checking the delivery status of an order, changing a delivery address only after approval from an authorized person, and blocking bulk customer data exports. It also maintains an audit trail to make decisions and execution results easy to review.

How we built it

We designed PermissionOS using React, TypeScript, and Tailwind CSS for the frontend, with Node.js and Express for the backend. The gateway uses the Model Context Protocol (MCP) to communicate with a separate downstream order service. We designed a deterministic policy engine to evaluate requests and SQLite to store approval records and audit events.

The system separates the AI agent's proposed actions from the actual authorization decision, ensuring that sensitive operations are controlled by backend policies rather than relying only on the AI's response.

Challenges we ran into

One of the biggest challenges was designing an approval workflow that genuinely prevents unauthorized actions instead of simply displaying a confirmation message. We needed to ensure that sensitive updates remain pending until an authorized person approves them, rejected requests never reach the downstream service, and repeated approval attempts do not execute the same action twice.

Maintaining consistent audit records and handling expired approvals, unauthorized requests, and potential execution failures were also important parts of the design.

Accomplishments that we're proud of

We are proud to have designed a system that brings human control and accountability into AI-powered tool execution. PermissionOS demonstrates a clear separation between requesting an action and authorizing it, with three distinct outcomes: ALLOW, REQUIRE APPROVAL, and DENY.

We are also proud of the project's focus on traceable decisions, controlled data modifications, and a reusable policy engine that can help developers build safer AI integrations.

What we learned

Through this project, we learned more about MCP-based communication, backend authorization, deterministic policy evaluation, and human-in-the-loop workflows. We also gained a better understanding of why security decisions must be enforced on the server rather than trusting prompts or client-side checks.

Most importantly, we learned that building trustworthy AI applications is not just about what an agent can do, but also about setting clear boundaries around what it is allowed to do.

What's next for PermissionOS

We aim to extend PermissionOS into a reusable authorization layer for AI agents across different applications and services. Our future plans include supporting more integrations, improving policy management, strengthening authentication, and enhancing audit capabilities.

We also want to develop mcp-policy-kit as a standalone open-source package so developers can integrate deterministic policy enforcement into their own MCP tools. Our long-term vision is to make AI-powered automation more transparent, accountable, and human-governed.

Built With

• access-control
• ai-agents
• audit-logging
• better-sqlite3
• express.js
• human-in-the-loop
• mcp-policy-kit
• mcp-typescript-sdk
• model-context-protocol-(mcp)
• node.js
• policy-engine
• react
• rest-api
• sqlite
• streamable
• tailwind-css
• typescript
• vite
• vitest
• zod