TwoKeys: AI Agents Can Act, but Should They Decide?

This article, created for the All Things Agentic Hackathon, explores the limitations of AI agents despite their ability to perform certain actions. TwoKeys, the proposed solution, ensures organizational consent is maintained by placing a decision boundary before consequential actions. The agent may propose an action, provide evidence, and even prepare the API request, but the actual execution requires approval from responsible individuals.

In the demo, a Revenue Agent proposes a €30,000 Google Ads campaign, which requires approval from Finance and the CEO. Each approval is bound to the action, evidence, policy, and version, ensuring that no executor call occurs without all required roles approving the same version. This approach prevents situations where different approvals lead to different realities.

The system treats every material change as a new immutable version, with each approval tied to the specific action, evidence, policy, and version. If someone adds a condition, the original approval becomes stale. The agent cannot choose its reviewers; instead, TwoKeys determines the required roles based on the material properties of the action using a deterministic policy.

If the action is routine, no human approval is needed; if it exceeds a certain threshold, Finance and the CEO are involved. The integration of the agent with TwoKeys is minimal, requiring the agent to propose an action and then await a decision. TwoKeys exposes this seam through HTTP, MCP, and a Google ADK adapter. Both Ana, from Finance, and Marco, the CEO, are presented with different interfaces tailored to their specific roles.

Finance focuses on affordability, downside, and remaining budget, while the CEO considers the right timing, potential reversibility, and what is given up by waiting. The system maintains a shared fact model across all components, but the presentation differs based on the user's role. One approved version results in one execution attempt, ensuring that once the permit is consumed, recovery requires reading the external state and reconciling any discrepancies.

By separating interpretation and determinism, the system allows models to focus on organizing evidence, explaining trade-offs, and presenting information to different roles, while deterministic code handles authorization and execution.