Developers are currently hitting a wall with AI agent autonomy. The dream is an agent that manages your email, updates your CRM, and coordinates your team's schedule, but the reality is a terrifying security gap. Handing a raw OAuth token or a master API key to a Large Language Model is essentially giving a stranger the keys to your digital life, hoping the prompt does not hallucinate a destructive command or fall victim to a prompt injection attack. The industry is realizing that the bottleneck for AI adoption is not the intelligence of the model, but the governance of its actions.

The Architecture of Decoupled Execution

Corsair enters this space as a TypeScript library designed to decouple the agent's intent from the actual execution of privileged actions. By installing packages under the `@corsair-dev/` namespace, developers can integrate a wide array of external services including Gmail, Slack, GitHub, Notion, and Stripe. The core architectural philosophy of Corsair is the elimination of credential exposure. In a traditional setup, an agent might be passed an API key in its context or environment, which is a significant vulnerability. Corsair changes this by handling API keys and OAuth tokens internally. The AI agent never touches the sensitive credentials; instead, it interacts with a set of defined methods and receives the resulting data, effectively creating a secure proxy between the model and the API.

This abstraction allows developers to add their own custom plugins to extend the agent's capabilities without rewriting the security layer. Because the library is released under the Apache-2.0 license, it provides a standardized way for teams to build a tool-calling layer that is portable and transparent. The focus is on creating a predictable interface where the agent requests an action, and the library determines if that action is permissible based on a predefined security policy.

Solving the Autonomy Paradox with Governed Agency

The real shift occurs in how Corsair handles the tension between autonomy and safety. Most AI frameworks treat permissions as a binary state: the agent either has access to a tool or it does not. Corsair introduces a nuanced governance model by implementing four distinct permission modes: `open`, `cautious`, `strict`, and `readonly`. These modes allow developers to define the baseline risk appetite for an agent. For instance, a research agent might operate in `readonly` mode for most services to prevent accidental data modification, while a personal assistant might operate in `cautious` mode.

Crucially, these settings are not global. Developers can override the permission mode for specific APIs, ensuring that a high-stakes tool like Stripe is treated with `strict` protocols while a Notion database remains `open`. When an agent attempts an action that crosses a safety threshold or requires explicit authorization, Corsair triggers a human-in-the-loop workflow. It generates an approval link with a 10-minute expiration window. The agent's execution is paused entirely, and the process remains in a pending state until the status is changed to `approved`. This prevents the agent from executing a chain of destructive actions in a split second before a human can intervene.

Security is further hardened at the data layer through envelope encryption. Rather than storing keys in plain text or using a single master key, Corsair utilizes a user-managed Key Encryption Key (KEK) to protect the data encryption keys. This ensures that even if the database is compromised, the credentials remain encrypted and useless without the KEK. For developers building AI-powered SaaS platforms, the library includes a `multiTenancy: true` configuration. This setting separates credentials and permission logic by tenant, ensuring that an agent acting on behalf of one user cannot accidentally access or modify the data of another user within the same application instance.

To handle the asynchronous nature of modern web services, Corsair provides specialized handlers for plugins that support webhooks. These handlers include built-in signature verification to ensure that incoming requests are authentic. This allows a developer to route webhooks from multiple different services through a single endpoint while maintaining a high security posture, as the library validates the source before passing the data back to the agent.

The industry is moving away from raw autonomy toward a model of governed agency.