Action-level authorization for humans and AI

Trust the action.
Not the application.

Application access is too broad for work that happens at machine speed. Just Auth evaluates each sensitive action on each resource in real time—using identity, intent, data context, behavior, and device posture—to allow, challenge, or deny.

See How It Works

One policy boundary across every path to your resources

Microsoft 365 Microsoft 365 AWS AWS Google Cloud Google Cloud Google Workspace Google Workspace Azure Azure Snowflake Snowflake Salesforce Salesforce Jira Jira GitHub GitHub Slack Slack Okta Okta ServiceNow ServiceNow

One decision for every action on every resource.

Just Auth turns coarse application permissions into contextual authorization at the moment a human or agent acts.

1

Understand the request

Capture who is acting, the exact operation and resource, the task behind it, the route being used, and the recent activity that gives the request meaning.

2

Reason over context

Apply a statically enforceable policy floor, then evaluate live signals such as intent, behavior, data sensitivity, work assignment, and device posture.

3

Enforce in the moment

Allow a safe action, challenge an ambiguous one, or deny and contain a risky one. Record the context, decision, and outcome as evidence for the next request.

One decision point. Every access path.

CLI

Evaluate commands, queries, and infrastructure changes inside developer workflows, CI/CD pipelines, and automation before they execute.

Network Proxy

Intercept API and data requests at the network layer, then make a resource-and-method decision without rebuilding every application.

Browser Extension

Bring action-level checks into Salesforce, Snowflake, and internal tools. Ask for added context only when an action is ambiguous or high risk.

$ justauth JIRA-1234
[justauth] Linked ticket: JIRA-1234
[justauth] Justification: "Investigate billing
discrepancy for Acme Corp account.
Read-only query to verify invoice
totals. Results shared in ticket."
 
(JIRA-1234)$ kubectl exec -it prod-db-0 -- psql
 
[justauth] Resource detected: production database
[justauth] Evaluating requested action...
 
Who: [email protected] (SRE)
Where: 10.0.4.12 / us-east-1 / VPN
Resource: prod-db-0 (customers.billing)
Action: read invoice totals via psql
Intent: resolve JIRA-1234 billing discrepancy
Scope: read-only, results to ticket
 
[justauth] Location: us-east-1 ✓
[justauth] Clearance: SRE / level-3 ✓
[justauth] Static policy floor: passed ✓
[justauth] Task and action aligned ✓
 
✓ ACTION ALLOWED
audit-id: 8f3a-c291-e7b0
decision context recorded to immutable ledger
 
$ justauth JIRA-5678
(JIRA-5678)$ kubectl exec -it prod-db-0 -- psql
 
[justauth] Resource detected: production database
Who: [email protected] (Intern)
Action: browse production customer records
Intent: "just poking around"
 
✗ ACTION DENIED
reason: action is outside assigned work,
intent is vague, and actor clearance is
insufficient for this sensitive resource
logged to immutable ledger
https://crm.acmecloud.com/accounts/aperture-bio/opportunities/renewal-2048

Aperture Bio Renewal

Account owner: Maya Patel • Segment: Enterprise Life Sciences

PII Protected
Opportunity Snapshot
Renewal value $482,000 ARR
Stage Security review
Requested artifact Customer usage report
🔒
Just Auth browser extension active

This action targets sensitive customer data. Just Auth will evaluate the user, resource, purpose, and intended use before it runs.

Timeline
Today Prospect asked for proof that each support action is evaluated and recorded.
Yesterday Security team requested a customer-by-customer retention summary.
Last week Renewal moved to executive review after data-governance questions.

Additional context required

This sensitive action needs a purpose and usage plan before the CRM can open the linked dataset.

Resource action intercepted by Just Auth
The decision combines static policy with customer context, intended use, and where the result will be shared.
Waiting for context...
✓ Action allowed

Read-only access allowed for renewal preparation. Decision `crm-4f21-992a` records the actor, resource, action, intent, and scope.

agent-runtime.log
$ justauth agent run --ticket REV-2048 --agent renewal-prep
[justauth] Agent session initialized: renewal-prep
[justauth] Downstream MCP and tool calls wrapped for policy enforcement
 
agentGoal: prepare renewal brief for Aperture Bio
agentPlanning next step: retrieve protected customer-health report
 
mcptool.call crm.getCustomerHealth(account="aperture-bio")
[justauth] Protected action detected: crm.customer_health.read
[justauth] Evaluating user intent, agent task, resource, and method...
 
agentcontext task=REV-2048, controller=maya.patel
"Read the Aperture Bio health report to verify support usage and renewal risk, then summarize only approved evidence in the REV-2048 memo."
 
[justauth] Applying static and dynamic policy...
user and agent intent aligned ✓
task permits renewal preparation ✓
resource sensitivity within policy ✓
method constrained to read-only ✓
 
✓ ACTION ALLOWED FOR AGENT
audit-id: agent-71ce-2048
tool call resumed with resource-scoped authority
 
mcptool.result risk_score=0.18, churn_flag=false, usage_trend="stable"
agentRenewal brief updated with approved evidence only
Ask about your access logs…
policy.justauth
Policy validated — 3 action rules, 2 contextual checks Ready to deploy

Decide whether this action is safe—right now.

🧠

Static floor, dynamic ceiling

Keep hard authorization and compliance guarantees, then add contextual reasoning for requests that are risky, complex, or ambiguous.

🤖

One model for humans and agents

Evaluate employees, contractors, service accounts, and autonomous agents against the same resource-and-action policy model.

📍

Context that follows the resource

Decide with identity, work assignment, resource sensitivity, intended method, recent behavior, location, and device posture—regardless of which tool initiated the action.

🔒

Adaptive challenges and containment

Ask for justification, stronger verification, or owner approval when context is missing. Deny or contain when risk crosses policy thresholds.

🤝

Decision evidence

Cryptographically record the actor, resource, action, context, verdict, and outcome. Give security teams, auditors, and customers evidence of what actually happened.

Keep authority as narrow as the work requires.

An application login should not become ambient authority over everything inside it.

🛡️

Reduce ambient authority

Grant the specific operation on the specific resource—not broad, reusable access to an entire application or dataset.

📈

Interrupt risk in real time

Move from after-the-fact investigation to in-the-moment decisions that can challenge, deny, or contain risky behavior before it spreads.

⚖️

Preserve verifiable controls

Keep explicit static policy as the security floor while dynamic reasoning adds precision where fixed rules cannot express the full context.

🔍

Explain every decision

Show who acted, what they tried to do, which resource was involved, why the policy reached its verdict, and what happened next.

1 action

Per decision boundary

3 verdicts

Allow · challenge · deny

2 layers

Static + dynamic policy

24/7

Human + agent coverage

Secure the operation, wherever it starts.

Sensitive Data

Resource-level data governance

Evaluate each read, export, update, or share against the data involved, the actor's assigned work, the intended use, and the surrounding activity.

Privileged Operations

High-risk infrastructure actions

Apply stronger checks to production changes, destructive commands, bulk operations, and unusual workflows without slowing routine, low-risk work.

AI Agents

Govern every tool call

Check that the user's intent, the agent's plan, the requested method, and enterprise policy remain aligned before each autonomous action executes.

See contextual authorization in practice.

Choose an action, add its task context, and see how Just Auth reasons about the specific operation instead of trusting the application around it.

Scenario: Customer data lookup Public demo endpoint Server-side rate limited

This demo is intentionally throttled to keep abuse and LLM costs down.

Get Started

Move the trust boundary to the action.

See how Just Auth can evaluate human and agent actions across your data, applications, APIs, and infrastructure.