AgentWicket: Approval controls for AI agent actions

The problem

Agents can now act. Most teams have no consistent control over what they do.

Teams are connecting AI agents to CRMs, order systems, help desks and email. Once an agent holds an API key, the line between what it suggests and what it does is often whatever a developer coded into one prompt or one integration.

The question an IT or operations lead needs answered is simple: which actions can this agent take on its own, which need a person to sign off, and what actually happened? Today that answer is usually spread across prompts, code and logs.

1
Permissions live inside prompts and code
"Don't issue refunds over $100" is written into a system prompt or an if statement in one integration. It isn't enforced the same way everywhere, and operations staff can't review or change it.
2
Approvals happen in chat threads
When a human check is wanted, it's often a Slack message or a ticket with no expiry and no link to the exact change that was approved. The agent might run something different from what was approved.
3
History is fragmented
Reconstructing why a customer's email address changed means piecing together agent logs, application audit tables and chat history, if they still exist.
4
Retries and duplicates cause real damage
A timed-out call that's retried can send the same message twice or apply the same refund twice. Every team ends up solving this themselves in each integration.

Product preview

One action request, from proposal to record

A fictional support agent asks to update a customer's contact details. AgentWicket shows the reviewer the agent's scope, the policy result, the exact proposed changes and how long the approval is valid. Try approving or rejecting it.

Action request · REQ-2041 Fictional demonstration

customer.update_contact

Awaiting approval

Submitted 10:42:07 UTC by support-agent-03 · Workspace demo-retail

Agent: support-agent-03 (identity verified)
Target system: crm-adapter → Customer records (demo)
Record: CUS-48213
Agent's reason: Customer wrote in from a new email address asking to update their account email and shipping address before an upcoming order.
Idempotency key: req-2041-7f3a9c

Registered scope for this agent

customer.read customer.add_note customer.update_contact order.read ticket.reply_draft

Proposed changes

Field

Current

Proposed

email

m.okafor@example.com

mo.okafor@example.netContact-identity field: approval rule applies

shipping_address.line1

14 Harbour Road

220 Wexley Lane, Apt 5

shipping_address.postcode

LS1 4AB

LS6 2QT

Policy evaluation (deterministic)

✓

identity.verified: agent credential is valid for workspace demo-retailRule: built-in

✓

scope.action_registered: customer.update_contact is in the agent's permitted action typesRule: built-in

✓

fields.allowed: all changed fields are on the allow-list for this actionRule: pol-cust-002

!

approval.required: changes to email require 1 approver from Support LeadsRule: pol-cust-007 · Result: REQUIRES_APPROVAL

Summary

AI-generated summary · optionalNot used for authorization

The agent wants to change this customer's email and shipping address based on an inbound support message. The new email uses a different domain from the one on file. You may want to confirm the request came from the account holder before approving.

Approval decision

Required approvers1 of Support Leads

Approval valid for18 min remaining

Action history

10:42:07
Request received from support-agent-03
10:42:07
Identity and scope validated
10:42:07
Policy result: REQUIRES_APPROVAL (pol-cust-007)
10:42:08
Added to Support Leads queue · expires 11:12:08
-
Waiting for a reviewer

InputA structured request from the agent: action type, target record, fields, reason.

ProcessingIdentity, scope and policy rules are evaluated. Same input, same result.

ResultPermitted, denied, or routed to the right approvers with an expiry.

ActionApproved requests run through the configured adapter, and the outcome is recorded.

How it works

Six steps, the same way every time

Agents don't call your systems directly for controlled actions. They submit a request to AgentWicket, and AgentWicket decides what happens next.

Agent submits action

A structured request through the API: action type, target, proposed changes and reason.

Agent

Validate identity & scope

Is this a registered agent, and is this action type one it's permitted to request?

Deterministic

Apply policy

Your rules decide: permit, deny, or require approval. Field limits, value thresholds, target types.

Deterministic

Request approval when required

The request goes to the right queue. Approvals expire, so a stale yes can't be used later.

Human

Execute via adapter

The approved change runs through a configured integration, exactly as approved, once.

Platform

Record result

The request, policy result, decision, execution status and response are stored together.

Platform

Core features

What the platform does

The initial feature set covers one job: putting a reviewable, recorded checkpoint between an agent's proposal and the change it makes.

Agent registry

Register each agent with its own identity and the specific action types it may request, such as customer.add_note but not customer.delete_record.

Why it matters: IT can see every agent that can act and what it is allowed to do, all in one place.

Structured action requests

Agents submit a typed request (action, target, field changes and stated reason) instead of free-form API calls.

Why it matters: Reviewers see an exact before/after, and policies can evaluate specific fields and values.

Deterministic policy checks

Rules that return permit, deny or require-approval based on agent, action type, fields and thresholds. No model is involved in the decision.

Why it matters: The same request always gets the same result, and you can explain exactly which rule applied.

Human approval queues

Requests that need sign-off go to the right group of reviewers, who see the scope, policy result and proposed changes before deciding.

Why it matters: Operations managers approve the actual change, not a chat message describing it.

Expiring approvals & execution status

Each approval has a time limit and applies to one specific request. Execution status (queued, running, succeeded, failed) is tracked on the request.

Why it matters: Old approvals can't be reused, and you know whether an approved action actually happened.

Action-history records

Every request is stored with its policy result, reviewer, decision note, timestamps and execution outcome, and you can filter by agent, action or record.

Why it matters: "Why did this customer's email change?" takes one search to answer.

Optional

AI summaries of proposed actions

When enabled, a short plain-language summary helps reviewers understand a request quickly. Summaries are labelled as AI-generated, are shown alongside the full structured request, and are never an input to policy evaluation or approval. They cannot grant permissions.

Who it's for

Built for the teams putting agents into production

Enterprise IT

IT and platform teams

Their problem: Business units want agents that can act, but IT has no consistent way to scope, approve or audit those actions across tools.
How AgentWicket helps: One registry of agents and permitted actions, central policies, and a single action history to review.

Operations

Operations managers

Their problem: They're accountable for customer-facing changes made by agents but can't see or control them without engineering help.
How AgentWicket helps: Approval queues that show the exact change, plus readable policies that say which actions need their team's sign-off.

Engineering

Developers building agents

Their problem: Every agent integration re-implements permission checks, approval hand-offs, retries and duplicate prevention.
How AgentWicket helps: Submit a structured request to one API and get a deterministic decision, a managed approval step and idempotent execution.

Use cases

Example policies by industry

These are illustrative configurations showing how teams in our focus industries could set up AgentWicket. They are not customer deployments.

E-commerce

Support and returns agents working in order and customer systems.

Action	Example policy
order.issue_refund	Permit up to $100; require one Support Lead above $100; deny above $1,000.
customer.update_contact	Address changes permitted; email changes require approval.
customer.delete_record	Not registered for any agent, so always denied.

Professional services

Agents that draft client communications and maintain CRM records.

Action	Example policy
message.send_email	Any message to a client contact requires approval from the account owner.
crm.update_opportunity	Stage and notes permitted; value changes require approval.
calendar.create_event	Permitted for internal attendees only.

Enterprise software

Agents supporting customer success and account administration.

Action	Example policy
account.change_plan	Always requires approval from Billing; approval expires in 15 minutes.
user.reset_mfa	Requires two approvers from IT.
ticket.add_comment	Permitted; recorded in action history.

How the technology works

Rules decide. People approve. AI only explains.

Authorization in AgentWicket is deterministic. Each part of a decision is labelled with how it was made, so reviewers and auditors know what to rely on.

DETERMINISTIC

Policy results

Identity, scope and policy rules are evaluated as code against the structured request. The same request and policy version always produce the same outcome.

HUMAN-REVIEWED

Approval decisions

An authenticated reviewer approves or rejects a specific request. The decision, reviewer and note are recorded and tied to that request only.

AI-ASSISTED · OPTIONAL

Summaries

A model may describe a request in plain language. Summaries can be wrong, are always labelled, and have no effect on whether an action is permitted.

# Example policy (illustrative format)
id: pol-cust-007
action: customer.update_contact
applies_to_agents: [support-agent-*]

when:
  changed_fields_include: [email, phone]
then:
  result: REQUIRES_APPROVAL
  approvers:
    group: support-leads
    minimum: 1
  approval_expires_after: 30m

otherwise:
  result: PERMIT

# Evaluation order: identity → scope → deny rules
# → approval rules → permit. No match = DENY.

AWS infrastructure

Being built on AWS

AgentWicket is being built on an AWS-first serverless architecture. The workload is a sequence of short API calls, rule evaluations, approval waits that can last minutes, and queued executions against third-party systems. Each service below covers one part of that sequence. This is the planned architecture for the pilot phase; it is being implemented now.

Status: planned architecture · implementation in progress

SourceAI agent

Calls the AgentWicket API with a structured action request and its scoped credential.

POST /actions

Entry pointAmazon API Gateway

Action-request endpoints for agents; approval endpoints for the reviewer workspace. Request validation and throttling per workspace.

DecisionAWS Lambda

Validates agent identity and scope, then evaluates policy deterministically and returns permit, deny or requires-approval.

read policy · write request

RecordsAmazon DynamoDB

Stores agents, policies, action requests, approval records and execution history. Conditional writes help prevent duplicate execution.

if approval required

OrchestrationAWS Step Functions

Runs the approval workflow: waits for a reviewer decision, enforces expiry, then hands approved requests to execution.

approved

ExecutionAmazon SQS + Lambda

Queues execution tasks so integrations can be retried safely and rate-limited. A worker calls the configured adapter.

TargetConfigured integration

The customer's application (initially one integration). The result is written back to the action history in DynamoDB.

Supporting services

ReviewersAmazon Cognito

Authenticates people who review and approve requests.

AccessIAM & scoped credentials

Least-privilege roles between backend components; scoped credentials per agent.

CredentialsAWS Secrets Manager

Holds integration credentials. Agents never see them.

OptionalAmazon Bedrock

Generates reviewer summaries. Has no access to the policy decision path.

OperationsAmazon CloudWatch

Logs, metrics and alarms for request latency, queue depth and execution failures.

Design choice: Bedrock sits outside the authorization path. Policy evaluation in Lambda reads only the structured request and stored policies, so a model's output cannot change whether an action is permitted.

Security & trust

Controls that are easy to explain

AgentWicket is an early-stage product. We don't hold security certifications today, and we'll say so plainly. The controls below are how the platform is designed.

Authentication

Agents authenticate with scoped credentials issued per agent. Human reviewers sign in through Amazon Cognito.

Access control

Each agent can request only the action types registered to it. Reviewers can decide only on queues they're assigned to.

Deterministic authorization

Permit, deny and approval requirements come from rules. AI summaries are not an input to any decision.

Credential isolation

Integration credentials are stored in AWS Secrets Manager and used only by the execution worker, never by the agent.

Encryption

Data is encrypted in transit with TLS and at rest using AWS-managed encryption on stored records.

Workspace isolation

Agents, policies, requests and history are partitioned by workspace.

Audit trail

Every request records its policy version, result, reviewer, note, timestamps and execution response.

Safe execution

Approvals expire and bind to one request. Idempotency keys and conditional writes are designed to stop the same action running twice on retry.

Covered What AgentWicket protects

Actions agents submit through the AgentWicket API
Changes executed through integrations configured in AgentWicket
Approval decisions made in the AgentWicket reviewer workspace

Not covered What it cannot see

Actions an agent takes using credentials or tools that bypass AgentWicket
Changes made directly in your systems by people or other software
The accuracy of the agent's reasoning. AgentWicket controls whether an action runs, not whether the agent's judgement was right.

For protection to be meaningful, agents should not hold direct write credentials to systems that AgentWicket controls. We help pilot customers set up that separation.

Scalability

Why the infrastructure needs to grow with usage

Load on AgentWicket rises with the number of agents customers run and how often those agents act. Most components are serverless, so costs follow real usage during the pilot instead of being provisioned ahead of demand.

What grows	Why it grows	Where it lands
Action requests	Each new agent or new permitted action type adds requests. A single support agent can propose many actions per day.	API Gateway, Lambda
Stored records	Every request, decision and execution result is kept for the action history, so storage accumulates over time.	DynamoDB
Concurrent approval workflows	Requests waiting for a reviewer stay open for minutes. More approval-required actions means more workflows running at once.	Step Functions
Execution tasks & retries	Each approved or permitted action becomes a queued task. Integration outages create retry backlogs.	SQS, Lambda
Integrations	Each new adapter adds credentials to manage and new call patterns to monitor.	Secrets Manager, CloudWatch
Summaries (optional)	Model inference scales with the number of requests that reach a reviewer, if the workspace turns summaries on.	Bedrock

Build plan

Start narrow, prove it, then expand

We'd rather get one integration exactly right than ship many that are only partly safe.

Phase 1 Current

One integration, a few action types

A single application integration
A small set of customer-record and messaging actions
Agent registry, policy checks, approval queue, history

Phase 2

Harden with pilot customers

Test approval expiry and multi-approver rules
Test retries and failure handling
Verify duplicate-execution prevention

Phase 3

Expand coverage

Additional integrations and action types
Broader policy conditions
Expansion driven by what pilots need

Pricing

Workspace subscriptions with action-volume allowances

You'll pay per workspace, with an allowance of action requests each month. We're setting prices with our first pilot customers, so there's no public price list yet.

Pilot

For teams putting a first agent behind controls

Pilot terms agreed per team

One workspace
One supported integration
Agreed monthly action allowance
Direct support from the founders

Request a Pilot

Team

For several agents across one business function

Planned · after pilot phase

Workspace subscription
Higher monthly action allowance
Multiple approval groups
Optional AI summaries

Talk to us

Enterprise

For organisations with many agents and teams

Planned · after pilot phase

Multiple workspaces
Volume-based action allowances
Additional integrations
Security review support

Talk to us

An "action" is one request submitted by an agent, whatever the result: permitted, denied or sent for approval. Allowance sizes will be set based on how pilots actually use the product.

Company

About AgentWicket

AgentWicket builds workflow controls for AI agents. We think agents will increasingly take real actions in business systems: updating records, sending messages, changing accounts. The organisations deploying them will need the same kind of clear permissions, approvals and records they already expect for people.

We're focused on e-commerce, professional services and enterprise software companies, where agents are already being connected to customer data and communications.

Over time we plan to support more integrations and action types so AgentWicket can be the single place a company defines and reviews what its agents are allowed to do. We're starting with one integration so we can get approvals, retries and duplicate-execution prevention right first.

Category: Enterprise AI workflow controls
Stage: Early stage · onboarding pilot customers
Focus industries: E-commerce, professional services, enterprise software
Business model: Workspace subscriptions

Team

Founders

Nathaniel Obinna

Founder

Oyin Dolapo

Co-founder

Pilot customers work directly with both founders, from setting up their first policies to reviewing their first approvals.

Request a pilot

Put your first agent behind clear rules

We're working with a small number of pilot teams. Tell us which agent you're deploying and what it needs to do, and we'll follow up to see whether AgentWicket fits.

Emailhello@agentwicket.com
Good fit if you
have an agent, or one planned, that needs to change records or send messages in a business system.

Give AI agents clear boundaries.

Waiting for review

Agents can now act. Most teams have no consistent control over what they do.

One action request, from proposal to record

customer.update_contact

Six steps, the same way every time

Agent submits action

Validate identity & scope

Apply policy

Request approval when required

Execute via adapter

Record result

What the platform does

Agent registry

Structured action requests

Deterministic policy checks

Human approval queues

Expiring approvals & execution status

Action-history records

AI summaries of proposed actions

Built for the teams putting agents into production

IT and platform teams

Operations managers

Developers building agents

Example policies by industry

E-commerce

Professional services

Enterprise software

Rules decide. People approve. AI only explains.

Policy results

Approval decisions

Summaries

Being built on AWS

Supporting services

Controls that are easy to explain

Authentication

Access control

Deterministic authorization

Credential isolation

Encryption

Workspace isolation

Audit trail

Safe execution

Covered What AgentWicket protects

Not covered What it cannot see

Why the infrastructure needs to grow with usage

Start narrow, prove it, then expand

One integration, a few action types

Harden with pilot customers

Expand coverage

Workspace subscriptions with action-volume allowances

About AgentWicket

Founders

Nathaniel Obinna

Oyin Dolapo

Put your first agent behind clear rules