.ai
GitHub 1.2k Log in Sign up

Open-source infrastructure for AI agents.

We research and build the open infrastructure for agents.

Onboard your agent
The OHQ wordmark built as a headquarters: its letters are walls, the O in grey. Lines of agents walk in through the open door of the O.

Products

PermissionAgentFGA

Fine-grained authorization for AI agents.

It decides what each agent can see and do, down to a single document, tool or record. Check every tool call, filter what reaches the model, and give agents access that expires. It speaks the OpenFGA API and runs on Cloudflare Workers, with one isolated store per customer.

Visit AgentFGA Get started
The AgentFGA mark, a gate A, built as walls. Agents walk in between its feet and stop at its crossbar, a grey gate. The gate sinks into the floor only for an agent with permission, which walks to the one tile behind it that it was granted. The rest are turned away.
agent.ts
import { OpenFgaClient } from "@openfga/sdk";

const fga = new OpenFgaClient({ apiUrl, storeId, credentials });

// Before the agent uses a tool, check that it may.
const { allowed } = await fga.check({
  user: "agent:support-bot",
  relation: "can_use",
  object: "tool:issue-refund",
});
Check latency at the edge
6msServer-side, when the store shares a data center with the request.
Store size tested
1.1MRelationships in one store, with no measurable effect on check latency.
Compared with OpenFGA
864,827Side-by-side requests against OpenFGA v1.22.0. Two differences, both caused by OpenFGA.
Found along the way
9Bugs in OpenFGA itself, reproduced and written up.

Reports

Published reports.

Method, numbers and caveats, written so you can check them.

The front door is open.

We research and build the open infrastructure for agents. Read the code, run it yourself and check our work.