The agent asks
It runs alicit run with a profile, a time limit and a justification. Nothing else changes in its workflow.
Private beta Credential approvals for AI agents
Your agents ask. You decide.
alicit puts your decision in front of every credential an agent uses. You see the exact operation on your phone, and Face ID or your fingerprint signs your answer.
Try it yourselfHow it works
One command. One decision.
The agent does not hold a standing token. It asks for the smallest profile it needs, for a short time, and it says why.
Your phone shows the request
You see the operation, its exact inputs and the reason. You approve it or decline it, and your phone signs your answer.
The credential stays sealed
The command gets a local proxy, not the real token. When the command stops, alicit revokes the token.
Try it
Your turn.
Approval requestednow
Open alicit to review.
Approve
Decline
5m 0s
All caught up
A new request appears here when an Agent asks for a credential.
History
No decisions yet
Every request alicit decides for you appears here.
Today
Up to 100 requests from the last seven days.
Profile
Signed in
Your approval key stays on this iPhone.
Hosts and Allowances
Releases a queue left checked out by an older app. It does not approve any request.
1.0.0 (1)
Sign out of alicit?
alicit
Your credentials. Your decision.
Swipe right to approve
Swipe left to decline
Face ID signs every decision
Sign in through the alicit Vault. Your approval key stays in the Secure Enclave.
All caught up
A new request appears here when an Agent asks for a credential.
No decisions yet
Requests you approve or decline appear here.
Up to 100 requests from the last seven days.
operatorYour approval key stays on this phone.
Notifications
Wakes are onA notification arrives for each new request.
Approvals
Operator actions
Diagnostics
Account
alicit 0.1.0 (1)
Sign out of alicit?
Requests stay waiting in the alicit Vault. Sign in again to answer them.
alicit
Your credentials. Your decision.
Review each requestSee which Agent asks, for what, and why, before any credential is released.
Your fingerprint signs every decisionA strong biometric unlocks the approval key for one signature at a time.
Keys never leave this phoneThe approval key lives in this phone's secure hardware. It cannot be copied or backed up.
Sign in through the alicit Vault with your Google account.
alicit
Touch the fingerprint sensor
A simulation made from a recorded run of the real alicit CLI and Vault, and from the real alicit iOS and Android apps. The Android app is not released yet. The simulation does not connect to a Vault.
Principles
Small, short and signed.
The smallest profile
An agent asks for one server-owned profile, such as read access to one repository. It does not get a broad key that works everywhere.
The shortest time
Tokens last minutes, not months. Each time the agent needs a new credential, it asks again.
A key only your phone holds
The approval key lives in the Secure Enclave of your iPhone or the Android Keystore of your Android phone. The server checks the signature before it issues anything.
Built on OpenBao
alicit runs in front of an OpenBao vault that you control. Policy decides what an agent can request. You decide what it gets.
Let your agents work. Keep the keys.
alicit is in private beta. Ask us for an invitation.