Embedded AI Agent Action Security API

What embedded Asyrx is

A risk-intelligence layer inside your product

Asyrx can be embedded as a risk-intelligence layer inside software platforms that enable AI agents to perform consequential actions. Before your platform executes a proposed action, it sends structured action metadata to the Asyrx Action Assessment API.

Asyrx returns decision-support intelligence: an Action Risk Score, a Blast Radius Score, a risk level, confidence, risk factors, reason codes, behavioral context, policy context and recommended controls.

Your platform remains responsible for user experience, authorization, policy enforcement, execution and final action handling. Asyrx never executes, approves or denies an action.

Asyrx returns

Action Risk Score
Blast Radius Score
Risk Level
Confidence
Risk Factors
Reason Codes
Behavioral Context
Policy Context
Recommended Controls

Core value

Build on Asyrx instead of building action-risk infrastructure from scratch

Platforms adding AI-agent functionality otherwise need to develop and maintain their own systems for evaluating consequential actions.

Action normalization

Contextual risk assessment

Impact estimation

Behavioral anomaly detection

Risk-factor classification

Reason-code generation

Blast Radius evaluation

Human-review recommendations

Auditability

Policy-aware context

High-impact action taxonomy

Asyrx provides this capability through an API. It does not remove your platform's own security engineering responsibilities — identity, authorization, tenancy, execution safety and product security remain yours.

What you can embed

Assessment output your platform can consume

Action Risk Score

Evaluates how concerning a proposed action is based on its context.

Blast Radius Score

Estimates the potential scope and severity of impact if the proposed action is wrong, compromised, unintended or inappropriate.

Risk Factors & Reason Codes

Returns structured, machine-readable explanations for elevated risk.

Behavioral Context

Adds context based on prior action patterns where configured.

Policy Context

Evaluates relevant enterprise policy conditions where configured.

Recommended Controls

Returns advisory recommendations such as HUMAN_REVIEW_RECOMMENDED, SECONDARY_APPROVAL_RECOMMENDED, VERIFY_DESTINATION, VERIFY_SCOPE, REDUCE_ACTION_SCOPE and CONFIRM_PRODUCTION_ENVIRONMENT.

Learn about Action Risk Score Learn about Blast Radius Score Explore high-impact agent actions

Platform remains the product

Your platform. Your experience. Asyrx underneath.

An OEM customer does not need to replace its interface, workflow, agent framework, IAM, authorization system, policy layer or execution layer.

What your platform can do with a result

Display a risk score inside your own UI
Trigger an existing human-review workflow
Require additional customer verification
Reduce the scope of the proposed action
Log the assessment for audit
Apply your internal policy
Request secondary review

Division of responsibility

Asyrx provides: Risk intelligence about the specific proposed action, with structured explanations and advisory recommendations.
Your platform determines: What appears in your product, which policy applies, who reviews, whether the action proceeds, and how it executes.

Embedded architecture

Where Asyrx sits in your stack

Asyrx is consulted before execution and returns intelligence only. It does not execute the target action, and it does not automatically approve or deny it.

01End user / enterprise customer
02OEM software platform
03AI agent proposes an action
04Asyrx Action Assessment API
05Action Risk · Blast Radius · Reason codes · Recommended controls
06OEM platform policy / workflow
07OEM platform or customer decides what happens
08Target system

The decision point is always inside your platform or with your customer. Asyrx has no connection to the target system and no ability to carry out the action.

Integration

One call before the action executes

An authenticated POST to /api/v1/actions/assess returns a complete assessment. The values below are the actual output of the Asyrx risk engine for this request.

POST https://asyrx.com/api/v1/actions/assess

{
  "agent_id": "agt_customer_operations_01",
  "target_system": "salesforce",
  "action_type": "crm.records.export",
  "environment": "production",
  "records_affected": 84000,
  "entities_affected": 84000,
  "data_classification": "confidential",
  "destination": "external_analytics",
  "reversibility": "partially_reversible"
}

200 OK — assessment

{
  "assessment_id": "asm_…",
  "action_risk": { "score": 60, "level": "moderate", "confidence": 0.77 },
  "blast_radius": { "score": 97, "level": "critical" },
  "risk_factors": [
    "NOVEL_DESTINATION",
    "HIGH_ENTITY_COUNT",
    "SENSITIVE_DATA_EXPORT",
    "PRODUCTION_ENVIRONMENT"
  ],
  "recommended_control": { "type": "SECONDARY_APPROVAL_RECOMMENDED" },
  "recommendations": [
    "VERIFY_DESTINATION",
    "VERIFY_SCOPE",
    "CONFIRM_PRODUCTION_ENVIRONMENT"
  ]
}

Developer portal Quickstart API reference Webhooks

No Asyrx UI required

Your users never have to leave your product

OEM customers can consume Asyrx entirely programmatically. Downstream users do not necessarily need to log into an Asyrx dashboard, encounter Asyrx branding, navigate away from your platform or change their existing workflow.

The Asyrx control plane may still be used for administration, configuration, audit, troubleshooting and assessment review, depending on how the commercial deployment is structured.

White-label positioning

Branding is a commercial decision

Embedded and white-label deployment requirements can be addressed as part of an OEM agreement. Possible configurations include invisible API infrastructure, Asyrx attribution, co-branded deployment or white-label implementation, subject to the applicable commercial agreement.

Nothing on this page grants white-label rights. Rights and restrictions are defined in the executed agreement.

Ideal OEM partners

Platforms Asyrx is built to sit inside

AI Agent Platforms

Platforms that let customers create or deploy autonomous agents.

Workflow Automation

Platforms where AI agents can trigger business processes and system actions.

Enterprise SaaS

Applications introducing agentic functionality into existing enterprise workflows.

Security Platforms

Products seeking additional context around consequential AI-agent actions.

CRM / ERP / Business Systems

Software where agents can modify high-value customer, financial or operational data.

Commerce & Fintech

Platforms where agents may initiate high-impact financial or transaction-related workflows.

Developer & Infrastructure Platforms

Software where agents can modify code, production infrastructure, access or system configuration.

Use-case examples

Routine actions and the ones that matter

Illustrative action-assessment examples. They do not imply a turnkey native connector for each platform.

Examples of routine versus high-impact AI-agent actions by platform type
Platform	Routine	High impact
CRM platform	Update 3 account records	Export 84,000 confidential records
Commerce platform	Refund $129	Refund $48,350 across 137 orders
Developer platform	Update a pull-request label	Delete a production repository
Identity / security platform	Normal access change	Grant administrator privilege across a critical environment

Layering

Asyrx does not replace identity or authorization

OEM customers typically use all three layers together.

Identity

Who is acting?

Authorization

Can this identity perform the operation?

Asyrx

What is the risk and potential consequence of this specific proposed action?

Platform-scale API

Built for programmatic volume

Multiple downstream organizations
Multiple AI agents
Multiple target systems
Organization-level isolation
Test and live environments
API-key management, scoping and rotation
Signed webhook delivery with retries
Idempotent retries
Policy context and versioning
Audit records for every assessment

Asyrx publishes no throughput or uptime benchmarks. Capacity and service levels are defined in the applicable agreement.

Tenancy

Isolation by organization and environment

Assessment context needs to remain separated by OEM customer, downstream enterprise, organization, agent and environment. Asyrx today enforces organization-level tenant isolation, so OEM deployment architecture can be structured around organization and tenant-isolation requirements as part of technical discovery.

Behavioral context

Compared against prior patterns

Where enabled, behavioral context compares a proposed action against prior patterns for the relevant agent or organization — typical financial values, normal entity counts, known destinations, common action types, action velocity and historical action patterns.

Behavioral context is always scoped to the organization it belongs to. One customer's action history is never used to assess another customer's actions, and Asyrx does not share customer-specific telemetry across tenants.

Data minimization

Send action context — not your entire dataset

Asyrx expects the structured metadata required to evaluate the proposed action, and nothing more.

Send

Target system
Action type
Financial value
Record count
Destination
Environment
Data classification
Reversibility
Privilege change
Relevant action context

Do not send

Complete prompts
Full chat history
Entire customer databases
Passwords
API keys
Authentication secrets
Private keys
Unrelated sensitive content

Commercial model

Structured around your deployment, not a price list

OEM and embedded agreements are structured around deployment requirements, committed assessment volume, support requirements, integration scope and commercial use. Asyrx does not publish OEM pricing and does not offer a free or self-serve OEM plan.

Agreement factors may include

Expected assessment volume
Number of downstream organizations
Support requirements
Deployment requirements
Branding / white-label requirements
Integration complexity
Service levels
Term commitment

Security posture

What an OEM evaluation can rely on

Tenant isolation

Organization-scoped data access enforced in the database, not only in application code.

API security

Scoped API keys with rotation and expiry, separate test and live modes, and per-request audit records.

Signed webhooks

HMAC-SHA256 signatures with timestamped payloads and retry with exponential backoff.

Asyrx holds no security certifications at this time and makes no certification claims. See Security & Compliance for the current, accurate position.

FAQ

OEM questions

Can Asyrx be embedded inside our software platform?

Yes. Asyrx is API-first. Your platform sends structured metadata describing a proposed AI-agent action to the Action Assessment API and receives decision-support intelligence back. There is no agent to install in your product and no requirement to adopt an Asyrx interface.

Does the end customer need to use the Asyrx dashboard?

No. Asyrx can be consumed entirely programmatically, and your users can stay inside your product. The Asyrx control plane may still be used for administration, configuration, audit, troubleshooting and assessment review depending on how the deployment is structured in the commercial agreement.

Does Asyrx authorize or execute AI-agent actions?

No. Asyrx evaluates a proposed action and returns intelligence: Action Risk, Blast Radius, risk factors, reason codes, behavioral and policy context, and recommended controls. Authorization, policy enforcement and execution remain with your platform and your customer.

Can Asyrx support multiple target systems?

The API accepts a target system, action type and supporting action context, so it is not limited to a fixed list of products. Salesforce, Shopify and GitHub are the documented reference scenarios; other systems are described through the same structured action metadata.

Does Asyrx offer white-label deployment?

Embedded and white-label deployment requirements can be addressed as part of an OEM agreement. Possible configurations range from invisible API infrastructure to Asyrx attribution, co-branded or white-label implementations, subject to the applicable commercial agreement.

Embed AI Agent Action Security into your platform