DEFCON ONE: AI Guardrails With a Human in the Loop

DEFCON ONE is a self-hosted AI safety control plane. It sits between your AI agents and the systems they can change, and it requires explicit human confirmation before any damaging change lands. Every privileged action follows the same path: propose, approve, audit.

What it is: an AI change approval workflow

When an agent wants to perform a protected action, it submits a proposal instead of executing it. The proposal carries the exact actions, the target environment, and a severity level. Nothing runs until a person approves it, and approval issues a single-use, time-limited execution token. Despite the name, this is not the military DEFCON alert scale; the levels here only rank how risky a proposed change is.

Who it is for: teams that let AI touch production

DEFCON ONE is for developers and operators who give coding agents and automation real access to servers, deploys, databases, and infrastructure. It is built for the point where you stop trusting an agent's judgment and start reviewing its exact commands. If your concern is how to stop AI from breaking production, this is the gate that makes that require your approval first.

Human in the loop, with an AI audit log that stays put

Every proposal, approval, and denial is written to an immutable audit log. Denials require a written reason, and that reason is stored permanently alongside the decision. Proposals are hashed, so the proposal you approved is the one that runs; any modification means a new proposal and a new approval.

Data and privacy: self-hosted by default

DEFCON ONE is designed to be self-hosted. You run the backend and the approval interface on your own infrastructure, and proposals, decisions, and audit entries live in your own database. There is no requirement to send your commands, diffs, or infrastructure details to a third-party service in order to get a change reviewed. The codebase is MIT licensed, so you can read exactly what the gate does before you trust it.

Common questions

Does this stop the AI from getting work done?

No. Unrestricted actions still run normally. Only protected actions are routed through the approval gate, so routine work is unaffected and the friction lands where it actually matters.

What happens if I never respond to a proposal?

Nothing executes. There is no timer that approves on your behalf. A proposal that is never approved is simply never run.

Can the guardrails be turned off?

Yes. There is an operating mode that runs everything unattended, and the interface asks you to confirm you understand what that means before it switches. It is a deliberate choice, not a quiet default.

How does an AI agent connect to it?

Through an MCP server, or the Python and TypeScript SDKs. The agent submits proposals instead of executing protected actions directly, then waits for an approval token before it can proceed.