# Lelu

An open-source authorization engine for AI agents that checks every proposed action against policy before it runs, adding prompt-injection detection and confidence-based human review.

Lelu sits between an AI agent and the actions it wants to take in the real world, such as issuing a refund, sending an email or deleting a record. Before the action runs, the agent asks Lelu over one HTTP call, and Lelu returns one of four decisions: allow the action, deny it with a reason, pause for human review, or redirect it to a safer sandboxed alternative, with every decision written to an audit log.

Where conventional authorization tools check whether an already-authorized agent is allowed to perform an action, Lelu adds checks for whether that authorized agent is currently being manipulated: a layered prompt-injection filter, confidence gating based on the model's own log-probabilities, and behavioral anomaly and reputation scoring, with human review routed through Slack, Teams or PagerDuty. It runs entirely on the user's own machine or infrastructure with no account or Docker required, and installs as an MCP server or as a Claude Code plugin that hooks directly into tool calls.

Website: https://lelu-ai.com/