Authorize agent tool calls before they run

01 · Role in the system

What Jev does here

Permissions alone miss the new failure mode: an agent can follow text it read in a document, and the user's permissions still allow the call. The guard verifies the access token, enforces Kinde permissions and flags, then sends every non-trivial call to Jev with the user's request, the tool call, and the documents the agent read - returning calibrated signals on match, destructiveness, planted-instruction following, and data egress plus a risk score. Code decides: allow, hold for ten-minute user approval behind a fresh sign-in, or stop; a low-confidence call escalates to an LLM judge, and the decision is written to a ledger before execution - if the write fails, the call does not run. Reads the user can already do skip Jev and cost nothing. Ships with a live ledger, an attack playground for planted instructions, and a benchmark of 300 labeled tool calls.

02 · Control boundary

Where Jev sits

Deterministic identity and permission checks first; one calibrated judgment on the ambiguous remainder; ledger-before-execution makes every decision accountable.

Code owns the loop, permissions, thresholds, validation, and side effects. Jev owns only the bounded judgments described above.

03 · Known limits

What this evidence does not prove

• Authorization judgment sees the request, the call, and the documents read - document content reaches the API for judged calls by design.
• The 300-call benchmark is the kit's own labeled set; behavior on your traffic needs the benchmark page rerun against it.
• A vendor starter kit: wiring assumes Kinde for identity and Convex for storage.

04 · Attribution

Public sources

This is a Community record: the project was published by a third-party community author.

• kinde-starter-kits ↗Community · github · public · checked 2026-09-24
• kinde-starter-kits ↗Community · demo · public · checked 2026-09-24