Salus

Teams deploying AI agents into production face a gap between authorization and correctness: an agent can have valid credentials, valid permissions, and a perfectly formed tool call, and still take the wrong action because it relied on stale or incomplete information. The page's example shows a booking agent proposing a reservation using an outdated saved itinerary price instead of checking live availability. Salus states that 53% of organizations have already had an agent exceed its permissions, pointing to this as a real and current operational risk rather than a hypothetical one.

Salus sits at the runtime boundary between an agent's intent and the real system it acts on, checking policy, evidence, and intent before a write reaches the provider. It works in three steps: Prevent, where unsupported or unverified writes are held before the backend performs them (provider_called: false); Repair, where the agent is returned the exact missing evidence or next step needed to correct the action (such as 'search live inventory'); and Prove, where every decision produces a receipt showing the policy, evidence, timing, verdict, and execution result. Integration is done in Python by wrapping an existing tool function with salus.protect(), specifying a risk level and whether the action has side effects, without changing the model, agent loop, framework, or backend. It is described as compatible with OpenAI, Anthropic, LangChain, LangGraph, CrewAI, AutoGen, Vapi, Retell, and MCP.