Local-first guardrail for AI coding agents

Move fast with AI agents.
Keep control when it matters.

Let allowed work run. Block the catastrophic. Hold the risky for human approval. Every decision leaves a signed audit record.

Install Belay See how it works

$ npm install -g @oz-lunara/belay

claude-code · agent session

# the agent proposes a schema change

agent$ psql $PROD -c "DROP TABLE users"

BLOCKEDDROP TABLE on production target 'prod': denied in-process.

blast radius: irreversible · this is catastrophic · the requester cannot approve this action

agent$ psql $PROD -c "UPDATE accounts SET tier='pro' WHERE id=42"

HELDawaiting human approval · approvalId apr_9f3c · reply to approve from your phone

…you approve from Slack or Telegram…

✓ ALLOWED: authorized by a human, this exact operation, once. Signed to the audit log.

How Belay works, at a glance

One action. Six steps.

Agent proposes

The agent is about to run a command or make a change.

Belay measures

Parses the command, introspects live systems, computes blast radius.

Belay evaluates

Shared, signed policies (code freeze, scoped tokens, secret scanning) are checked.

Human decides

If risky, Belay blocks and requires a human approval.

Action proceeds

Once approved, the action executes in your environment.

Receipt proves

Every decision and execution is signed and verifiable offline.

THREE OUTCOMES. NOT ONE GATE.

Precision without slowing everything down.

Belay separates what can proceed from what must stop or wait for a human. The goal is control at the moments that matter, not approval fatigue.

PASS

Allowed work continues

Actions allowed by policy continue without unnecessary human approval.

BLOCK

Catastrophic actions stop

Deterministically destructive production actions are denied before they execute.

HOLD

Risk waits for a human

Consequential actions can pause for approval from an authorized human before continuing.

One action. Every step.

Scroll through a single command, the way Belay sees it.

01 · Proposes

The agent decides to act.

Claude Code, Cursor, Codex, Copilot: any agent, any shell. The moment it reaches for a command, Belay is already watching, running locally on your machine.

agent · bash (psql)

$ psql $PROD -c "DROP TABLE users;"

env: production

02 · Intercepts

Protected actions are evaluated before they continue.

On a hooked agent surface, the call is caught before it leaves your shell. On a PostgreSQL connection routed through Belay, the query is caught before it reaches the database. Either way, evaluation happens locally: your code and data never leave the machine.

status

⏸ Held

command not yet executed

03 · Measures

Belay reads the system, not just the command.

It resolves what the query actually touches (rows, tables, the services that depend on them), so "blocked" or "fine" is a measurement, not a guess. The full preview renders in under 500ms.

blast radius

users

orders

sessions

invoices

billing

analytics

notifications

rows (est.)12,482

lockACCESS EXCLUSIVE

duration (est.)18s – 46s

04 · Evaluates

Then it checks the rules your team already set.

Environment, code freeze windows, scoped tokens, secret exposure: shared, signed policies your team set once, applied identically across every protected surface, automatically.

environmentproduction

code freezeinactive

scoped tokennot present

secret scanclean

rule matcheddestructive.operation

decisionblock

05 · Escalates

A person decides, not the agent.

High risk, wide blast radius: that combination doesn't get an automatic yes. It reaches someone on Slack or Telegram, wherever they are. By policy, nobody approves their own protected action.

approval requested · sent to slack + telegram

Sarah · approved from iPhone

requested by claude-code · risk: high

✓ ApprovedReject

06 · Proceeds

Belay releases it. Your environment runs it.

Belay never executes anything on your behalf; it only decides whether the agent's own command is allowed to continue.

$ psql $PROD -c "DROP TABLE users;"

✓ Executed · 5.4s

<500ms

decision latency, CI-gated. Belay never becomes the reason your agent stalls.

bytes of code or data that leave your machine. No cloud dependency in the enforcement path.

Read-only

Belay's own database role. It can look at your schema; it cannot write to it.

Opt-in

Telemetry is off by default, and content-free even when enabled: counts, not queries.

100%

catch rate on the deterministic destructive test corpus: DROP, TRUNCATE, unqualified DELETE.

<1%

false-positive rate on the safe-action corpus. Belay stays quiet on the 95% of calls that are fine.

07 · Proves it

Every decision is verifiable, offline, forever.

Belay writes an append-only, hash-chained log and signs every decision and execution. The agent cannot forge a receipt or lie about what ran. No account needed to check it, the receipt proves itself.

receipt · verified ✓

actionpsql $PROD -c "DROP TABLE..."

verdictblocked → approved

approversarah@company.com

environmentproduction

action ida1f4c9e6-8a2b-4d6d-9a1d

signatureCOSE_Sign1 (Ed25519)

verify · offline

$ belay verify

✓ 519 receipts verified

✓ every signature valid

✓ chain unbroken

result: OK

belay session show replays exactly what ran in a session, matched receipt by receipt.

Where Belay enforces

Belay protects actions where they actually happen.

Enforcement runs on two surfaces today: the agent's tools, and the database connection itself.

Agent & tool surfaces

Belay hooks into the coding agent or tool you're using. Protected actions on these surfaces are evaluated before they continue.

Claude CodeCursorCodex CLIVS CodeMCP Server

PostgreSQL connection

Belay can also sit at the connection layer, evaluating a query before it reaches PostgreSQL, even one that didn't originate from an agent hook.

Application / Client

driver · ORM · GUI · agent

→

Belay

evaluate · block · hold · allow

→

PostgreSQL

receives only what Belay allows through

Connection-level protection applies when your application is configured to connect through Belay.

Team rules

One rule set. Across your team.

Apply the same signed rules across machines, approvals, and protected resources.

Shared policies

Apply the same signed, verifiable rules across the team.

Separation of duties

Nobody approves their own protected action.

Fleet visibility

See which machines are enrolled, current, behind, or overridden.

Central freeze

Hold protected changes across the team when necessary.

Cross-machine audit

Collect and independently verify signed activity across machines.

Conflict awareness

Surface potentially conflicting actions occurring across the team.

Latest from Belay Intelligence

Explore Intelligence →

Works where your agents do

Claude CodeCursorCodex CLIVS CodeMCP Server

One policy, applied the same way across these agent and tool surfaces. More integrations coming soon.

Get started in under 5 minutes

Install → Setup → Protected.

Install

One command, zero signup required.

Setup

Auto-detects Claude Code, Cursor, Codex, VS Code.

Protected

Interception starts instantly.

$ npm install -g @oz-lunara/belay

$ belay setup

Full getting started guide →

Pricing

Simple, fair pricing.

Belay checks protected actions against your live database, holds risky ones for approval, and creates a signed receipt for every decision.

Start here

Belay Experience

Experience Belay on your first 3 protected actions.

3 protected actions included. No time limit.

Protect

For one developer protecting one production PostgreSQL database.

€19/month

For growing teams

Scale

For teams that need shared control over AI agent actions.

From€89/month

Enterprise

For organizations deploying Belay across teams, environments, and security boundaries.

Talk to us

Shipping today · v0.3.x

See Belay protect your first 3 actions.

Install Belay, connect your PostgreSQL database, and experience three real protected actions. No time limit.

Install Belay Read Belay Intelligence

Move fast with AI agents.Keep control when it matters.