Give your agents autonomy.
Not unlimited authority.
Stop choosing between approving every action and giving your agent unrestricted access. Belay lets routine work pass, holds risky actions for your approval, and blocks recognized catastrophic actions before execution.
Get early access to Belay.
Approving everything isn't control.
More autonomy means more actions. If every one of them needs a yes, you end up watching the agent work instead of getting your time back. Turn approvals off to get that time back, and the agent can run anything your shell can run.
Every command stops and waits. You end up babysitting the agent, clicking approve on the same routine commands over and over, until you either stop reading them carefully or stop delegating the work in the first place.
Turn approvals off and the interruptions stop, but so does the differentiation. A read-only query and a destructive one run the same way: whatever the agent decides to execute, executes.
Belay is built for the space in between. Being able to run a command and being authorized to run it are not the same thing.
Different actions deserve different outcomes.
Belay separates protected actions into three clear outcomes: what proceeds, what needs your approval, and what gets blocked. Routine work stays routine. Consequential actions get a human. Catastrophic ones stop before they execute.
Keeps moving
Routine, low-consequence actions run without stopping to ask. Most of what your agent does falls here.
Waits for you
Consequential actions pause for your approval before they continue. Not everything, just the ones that matter.
Never runs
Recognized catastrophic, irreversible actions are denied before they execute. Not even you can approve these.
Most protected actions get a quiet PASS. Belay speaks up only when the consequence changes.
One action. Three possible endings.
The same evaluation runs every time. Where it ends, PASS, HOLD, or BLOCK, depends on what the action actually is.
The agent decides to act.
Claude Code, Cursor, Codex, Copilot. When the agent reaches for an action on a surface Belay covers, Belay sees it first, running locally on your machine.
Recognized protected actions are caught before they run.
On a hooked agent surface, the call is caught before it leaves your shell. On a PostgreSQL connection routed through Belay, the query is caught before it reaches the database. Either way, evaluation happens locally: your code and data never leave the machine.
Belay checks the action and its target.
Belay identifies the action and its target, then checks them against your configured policy before execution. The same policy applies across every protected surface.
Then it branches
Continues immediately
Read-only, staging, or otherwise within policy. The command runs without waiting on you. Belay still writes a signed record of the decision.
Waits for a decision
Consequential, but potentially legitimate. Execution pauses until a human responds. Approve and the command runs. Reject, or let the window pass unanswered, and it stays stopped, never approved by default.
Denied outright
Catastrophic and irreversible on production. Belay refuses it before it runs. Nobody, not even you, can approve it from here.
PASS, HOLD, and BLOCK, and any approval or rejection along the way, are all written to Belay's signed, local audit log the moment they happen. Nothing has to be approved first to be on the record.
Every decision is verifiable, offline, forever.
Belay writes an append-only, hash-chained log and signs every decision and execution. The agent cannot forge a receipt or lie about what ran. No account needed to check it, the receipt proves itself.
belay session show replays exactly what ran in a session, matched receipt by receipt.
Belay protects actions where they actually happen.
Enforcement runs on two surfaces today: the agent's tools and the database connection itself. Belay evaluates protected actions on those surfaces before execution, using the same policy to decide what proceeds, what needs approval, and what gets blocked.
Belay hooks into the coding agent or tool you're using. Protected actions on these surfaces are evaluated before they continue.
Belay can also sit at the connection layer, evaluating a query before it reaches PostgreSQL, even one that didn't originate from an agent hook.
Connection-level protection applies when your application is configured to connect through Belay.
Latest from Belay Intelligence
Explore Intelligence →Be among the first to use Belay.
We’re opening access progressively to people building with AI coding agents.