S-05
suspended
Paused. Credentials cannot be issued while an agent is here.
Know exactly which agent is acting.
A decision is only as good as the identity behind it. Anubis gives every agent a registered identity, a reviewed risk profile, a controlled lifecycle, and a credential that cannot be borrowed by anything else.
agentfinance-reconciliation-agent
ownerplatform-security
frameworkLangGraph
environmentproduction
statusproduction · v12
risk_score64 / 100 · high
tools9 registered
policyProduction finance controls (v12)
Every agent has a record before it has access.
An agent is registered with its owner, team, model, framework, environment, the tools it may call and the permissions it holds. That record is the unit everything else attaches to: a runtime credential is bound to an agent, a policy is bound to an agent, a decision is attributed to an agent, and the kill switch contains one.
Anubis does not discover agents for you. There is no traffic interception and no process-wide hook. Registration is deliberate, and that is the point - an inventory you did not curate is not an inventory.
Production is a state an agent is moved into, not a default.
Transitions are checked against the current state, and terminal states are terminal.
draft
Registered and described, not yet reviewed. No production credential exists.
in_review
Submitted for review, with a background check and a deterministic risk score attached.
approved
A reviewer accepted it, on the record, with policy bound.
production
Operating. Promotion between environments invalidates existing credentials; the recovery is rotation.
S-06
revoked · retired
Terminal. Any further transition is refused rather than quietly applied.
S-07
versions & rollback
An agent carries versions. Rolling back records what changed and why, in one transaction.
A credential that names one agent.
This is the mechanism that makes identity unspoofable at runtime. It is also the one thing you have to store carefully.
anb_v1_live_<key_id>_<secret>
The environment (live or test) is carried in the token itself. It resolves one organization, one agent and one environment, plus an explicit scope set. POST /api/runtime/evaluate requires the runtime:evaluate scope.
C-01
Issued deliberately
By an admin, for a specific agent. Refused for a revoked, retired or suspended agent - issuing one would undo the kill switch.
C-02
Shown once
Anubis stores no copy of the secret. Lost means rotate; there is nothing to look up.
C-03
Rotated and revoked
Both are audited control-plane operations, and neither is retried automatically because neither is idempotent.
C-04
Never in a browser
A runtime credential is a bearer token for a server-side runtime. The TypeScript SDK is Node-only for exactly this reason.
Two credentials, never interchangeable. A control-plane token authenticates you - a human with a role - and cannot evaluate a tool call. A runtime credential authenticates one agent and cannot read anything in the control plane. That split is the product's design, and it is why an agent can never approve itself.
A score you can argue with.
Anubis computes a deterministic, weighted risk score across ten dimensions, with the findings that produced it. It is not a black box and it is not a model's opinion: the same inputs produce the same score, and you can see which factors moved it. A background check runs alongside, using live source and advisory lookups where they are available and a deterministic offline fallback where they are not.
Risk is not a parameter of a runtime request. The engine computes it, so a caller cannot soften its own score.
lifecycleproduction
containedfalse
credentialactive · in scope
environmentmatches credential
resultcontinue to policy
One switch, and it stops asking politely.
Containment is an emergency control-plane action against one agent. Once contained, every tool call that agent evaluates through Anubis is blocked - whatever its policy says, in every environment its credentials reach, immediately.
It is exactly as strong as your integration, and we would rather say so here than let you discover it during an incident. Containment stops the calls that ask. A code path that never calls Anubis is not governed, and the kill switch cannot reach it either. Coverage is the work.
- 09:41:02crm.contact.readpreviously allowedblock
- 09:41:04warehouse.query.runpreviously allowedblock
- 09:41:09slack.message.sendpreviously allowedblock
decision_source: trust_gate - the policy was never consulted.
Roles enforced on the server.
Not in the interface. The API refuses whatever the UI would have hidden.
| viewer | Reads agents, decisions and evidence within the organization. |
|---|---|
| owner | Registers and maintains the agents they are responsible for. |
| security_lead | Resolves approvals and governs policy. The only role that can decide a held action. |
| admin | Issues, rotates and revokes runtime credentials. |
Every agent, policy, credential, decision, approval and audit entry belongs to exactly one organization, and nothing crosses. An id belonging to another organization is reported as not found, identically to an id that does not exist - so the API cannot be used to probe for another tenant's records.
Private access
Put a name on every agent with access.
We will walk through the registry, the credential model, and exactly what containment reaches.