How It Works
Human & AI Action Gateway
Transcodes governs risky actions by humans and AI agents — same roles, same rules, one audit trail.
| Who | Passkey login (no passwords) |
| What | RBAC per resource:action — deny / allow / allow + step-up |
| Proof | Biometric step-up before dangerous actions |
| Record | Step-up MFA, SDK events, and guard outcomes in audit log |
Connect via transcodes-guard (AI Agent) or the browser SDK (web app). Both use the same Transcodes Cloud backend, RBAC, and audit log.
Start
# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/transcodings/transcodes-guard/prod/cli/install.sh | bash && transcodes install
# Windows (PowerShell):
# irm …/install.ps1 | iex; transcodes install| Path | For | Docs |
|---|---|---|
| A | AI Agent — guard risky shell / MCP calls | AI Agent |
| B | Web app — redirectToSignIn · redirectToStepUp · redirectToConsole (Coming Soon) | Admin Back-office |
The three actors
| Actor | Surface |
|---|---|
| End user | Transcodes Auth — login, manage passkeys |
| Operator | Console — roles, tokens, RBAC matrix |
| Human approver | Transcodes Auth — step-up before risky actions |
| AI agent | MCP in IDE — same RBAC as the token holder |
Login, step-up, and credential management share Transcodes Auth (sign-in · step-up · console). Your app redirects with ?sid=…; no embedded auth UI.
Login
SDK: redirectToSignIn({ redirectUri }) → handleSignInCallback() on return. Private keys stay on device; the server stores only public keys.
Step-up
Already logged in, but the action is dangerous — prove it again with biometrics (delete member, change roles, AI calling retire_member).
SDK: redirectToStepUp({ resource, action }). Session TTL: 10 minutes. Full guide: Step-up Auth.
RBAC
| Level | Meaning |
|---|---|
| 0 | Deny |
| 1 | Allow |
| 2 | Allow + step-up |
Resources (members, roles, …) × actions (create, read, update, delete). Same matrix for SDK and MCP — backend is the authority. See RBAC.
AI agents
The agent acts as the member in its token. Read/list operations proceed; tier-2 actions are blocked until a human completes step-up.
Store tokens in {{HOME_DIR}}/.transcodes/config.json via the CLI — never paste into chat.
Auth methods
Passkey (primary) · TOTP · hardware key · email OTP · passcode (recovery). Register at least two methods per member.
What you still own
| Transcodes | You |
|---|---|
| WebAuthn, hosted auth page, JWT issuance | App UI and business logic |
| RBAC storage & enforcement | Role/resource setup in Console |
| Audit log storage | Optional trackUserAction from your app |
| MCP tools & guard | Host plugin install, token security |
Transcodes is not a full app-security platform — you still own CSP, XSS prevention, and HTTPS.