Proof a person said yes, to this exact action.
Flint Approve is the safety layer inside every connector we build. It sits between the AI agent and your systems and decides, in software, what the agent may do on its own, what needs a person, and what is never allowed.
Early-stage software. Not independently audited or certified. Details below.
The agent never holds your keys
The agent only gets its own Flint credential. Your Stripe key or helpdesk token stays with the gateway, so the agent cannot skip a control by calling your system directly. Limits are enforced by the server, not by instructions in a prompt.
AI agent (any MCP client)
| MCP
v
MCP connector holds one agent credential
|
v
Flint Approve scopes, limits, allowlist,
| approval, stop switch, ledger
v
Your system Stripe, helpdesk, your API
person <- one-time approve link
admin -> stop switch, undo, signed export
What it enforces
Each control below exists in code and is covered by automated tests. Everything is shown in the recorded demo run except the two items marked new.
The agent's own login
Each agent gets its own credential, with read and write access listed separately. Admin keys are refused on agent endpoints, and agent credentials are refused on admin endpoints.
Signed, single-use approvals
The approver sees the exact tool and arguments, not a summary the agent wrote. Approval issues an Ed25519-signed token bound to that action. It cannot be replayed or reused on a different one. New: approvers can be required to add a code from their authenticator app, and every approval carries a signed receipt naming who approved and how.
Hard limits in software
Money per action and per day, records per action, actions per minute, and a monthly usage budget. Over-limit calls are blocked and recorded before they reach your system. Limits hold even when many calls arrive at once, across servers.
A stop switch your team holds
Stops new work, aborts work in progress, cancels pending approvals and revokes unused ones. No ticket to the vendor needed.
Undo, or approval first
Reversible actions can be undone by your admin. Actions without an undo, like refunds, need a person before they run. New: your team can let small amounts run on their own (off by default, daily cap, and turning it on needs a second person).
A signed record you keep
Every input, step, approval, block and undo, exported as signed JSON or CSV with timestamps. It verifies offline, and edits are detected.
Outside text is treated as untrusted
Customer content is tagged and scanned for injection signals. Outbound destinations must match an allowlist, and after untrusted input even allowed sends need a person.
Nothing runs on silence
Unanswered approvals escalate to a backup approver, then deny by default. Agents can hand a task to a person.
Limits change only with approval
A limit or instruction change waits for a second person. The history is signed and names who asked, who approved and when.
Checked against a public buyer questionnaire
We test Flint Approve against the 20 requests in the MACH Alliance "Vendor Questionnaire: AI Agent Safety" (September 2026), a public document enterprise buyers can use to evaluate agent vendors. This is our own self-assessment, not an independent audit, and Flinttech is not affiliated with the MACH Alliance.
| Area | Our self-assessment | Notes |
|---|---|---|
| Live demonstrations (requests 1 to 9) | All 9 met in our testing | Shown on test systems. The questionnaire treats a demo on a different setup than the buyer's as weak, so for a buyer we run it on their sandbox. |
| Documents and written answers (10 to 20) | 7 drafted, 2 partial, 2 not met | Drafts count only once signed. Partial: the full list of data recipients (waits on choosing a database host) and test results on a buyer's own setup. |
| Not met yet | 90-day production report, certifications | Flint Approve is not yet in production and holds no certifications or independent assessments. |
Known limits
We would rather you hear these from us first.
- Not independently security audited, and no certifications held.
- Not yet running in production for any customer.
- By default, an approver is whoever holds the emailed one-time link. Approvers can add an authenticator-app code so the link alone is not enough, but setting that up trusts their email inbox once. Single sign-on and passkeys are not built yet.
- The injection scan is a heuristic. The real protections are the allowlist and the approval step.
- If an approved action then hits a limit, it is blocked and needs a new approval. It never runs over the limit.
- Authenticator codes and small-amount auto-approval are new. They pass automated tests but have not run in a customer setting yet.
$300 to $500 a month, after your connector goes live
Flint Approve comes with every Integration Sprint. The care plan keeps it running and current once agents are using your product.
- Approvals, limits and stop switch kept running
- MCP protocol and SDK updates
- Rule and limit changes on request
- Signed audit exports whenever you need them
Final price depends on the number of agents and connectors, and is set in the written scope.