Overview Capabilities Agents Gateways Workflows Trust

Trust

Trust the boundary. Not the prompt.

Every side effect crosses one door. Every answer becomes durable evidence. Every actor keeps a name.

Admission · payments.transfer decision → evidence

IntentAgent

resolved actor agent:billing-ops acting for · user:dana

toolpayments.transfer

tovendor-311

amount$2,400.00

tieract

crossesone call

The door● live

hardline: no denial
authority: grant active
surface: interactive

asksexact intent

Human decisionresolved

Approval requiredact

Transfer $2,400 to vendor-311?

May invoice · net 30

Approve onceDeny

✓ approved by user:dana14:23:44.115scope · this call

01intent recordedtool + arguments

02paused durablyno executor reached

03human resolvedidentity attached

04authority recheckedgrant still active

05executed onceresult journaled

the Agent cannot approve itself a restart cannot erase the pause the receipt outlives the Run

The trust model

Controls live outside the thing they control.

Models propose. Programs order work. Plugins, Sandboxes, Computers, and connectors execute. None of them owns the identity, authority, admission, or record that governs the call.

The control plane stays outside every execution tier. A powerful runtime can do real work without gaining a path back into the loop that decides what it may do.

system boundarycontrol ≠ execution

control plane

01Identitywho is acting

02Authoritywhat is granted now

03Admissionmay this call execute

04Journalwhat became true

execution

◇Modelproposes

▲Pluginin-process WASM

▢Sandboxsession-scoped

▣ComputerAgent-bound

the machine is never the brainno tier governs itself

01 · one door

Execution requires proof.

The executor only accepts an admission minted for that call. Policy is structure, not prompt etiquette.

02 · one truth

The journal is the runtime record.

Replay, audit, model attempts, decisions, results, and usage resolve from the same event-sourced truth.

03 · real identity

Agents are principals.

The actor and the caller it represented stay attributable—even when one Agent delegates to another.

Authority at both seams

“May” is answered per operation.

Identity enters the platform without carrying frozen authority. Roles, grants, and scope are loaded when the operation is decided—whether the operation changes configuration or touches the outside world.

principal · user:danaidentity only at the edge

01 · management planeConfigure the system

operationcapability.unbindagent:support

authorityload current snapshotrole + grants

Authorizationservice may mutateaccount floor remains

02 · runtime planeExecute an effect

operationpayments.transferAgent call

admissionevaluate this callfloor + grant + policy

Admissionexecutor may runone call · one proof

authority is read nowproof is scoped to one operation

The decision path

Policy is evaluated where execution begins.

The door does not ask whether the Agent sounds confident. It evaluates named inputs in a fixed order and returns exactly one product answer: allow, pause, or deny.

Admission request · support.issue_refundlive evaluation

call context

actoragent:support

surfaceAgent · interactive

tool tieract

amount$184.00

ordered checks

01Hardline floorno denial

02Current authoritygrant active

03Recorded resolutionnew call

04Invocation policysupervised

05Risk decisionact → ask

one answer

ALLOWmint proofexecutor reachable

PAUSEwrite pending gatehuman reachable

DENYrecord reasonexecutor unreachable

a code-level floor no admin can softenunattended would-pause → deny

01 · read only

Explore without acting.

Read-tier calls can run. Act and Privileged calls are denied.

cautious posture

02 · supervised

Act with a person in the loop.

Reads flow. Higher-risk calls pause unless an applicable approval has already been recorded.

human judgment where it matters

03 · full

Run unattended within the boundary.

Calls may run autonomously; live denials, user pins, and the hardline floor still stand.

authority is never ambient

Durable human judgment

A pause is a state. Not a spinner.

The pending gate records the exact call and releases the Run. A restart can happen. A different pod can take over. The human decision still resolves the same held intent.

Resume re-enters the door: the current authority outranks an older approval. The held call executes once—or stays denied.

pending gate · gate_01J9K6● waiting

01 · sealExact intenttool · args · actor

02 · persistPending gatedurable state

03 · waitHuman decisionno active Run

04 · resumeRe-enter doorauthority rechecked

05 · dispatchExecute onceresult recorded

pod Apauses the callRun released

durable stategate + wakeupshared truth

pod Creceives the resolutionsafe to resume

survives process lossresolves across podsresumes once

Live authority

Stable enough to reproduce. Live enough to revoke.

A conversation keeps the tool presentation it started with. Permission does not freeze with it: grants are read at decision time, and revocation reaches every pod within seconds without session affinity.

authority change · capability:paymentspropagation preview

conversation · frozen presentation

filesknowledgepaymentsmemory

names stay stable in context

14:22:04 · admin decision Unbind payments authority ledger updated

all serving pods

pod A currentpod B currentpod C current

no session affinity required

14:22:08agent:billing → payments.transfersame conversation

current grantDENYbinding no longer active

not a mid-flight cancellationtakes effect on the next call—and again on gate resume

journal · support/refund-184source of truth

14:02:11.482Run startedagent:supportthread · client-acme

14:02:12.190Model attempt failedagent:supportroute A · before commit

14:02:12.904Model attempt completedagent:supportroute B · fallback

14:02:13.907Admission pausedagent:supportsupport.issue_refund · act

14:23:44.115Gate resolveduser:danaallow · this call

14:23:45.002Capability completedagent:supportrefund · success

14:23:45.618Run completedagent:supportusage reconciled

replayauditmetricsbilling reconciliation

One truth

The receipt is part of the runtime.

The journal is not a chat transcript with extra fields. It is the append-only source for conversation replay, every model attempt and route, capability results, autonomy decisions, and usage reconciliation.

A provider failure does not disappear behind the answer that eventually worked. A human decision does not become an editable note. “Why did this happen?” resolves to events, not reconstruction.

principal chain · refund decisiondelegation preserved

humanuser:danainvoking caller

Agentagent:supportdelegates billing work

Agentagent:billingresolved actor

Capabilitypayments.refundadmitted call

actoragent:billing

acting foruser:dana → agent:support

decisionallow · admitted

Execution isolation

Power runs outside the control loop.

Each workload gets an explicit execution boundary. Identity, authority, admission, and the journal remain in the platform control plane—not inside the code or machine doing the work.

01 · plugin▲

Sandboxed in process

Versioned, permissioned customer logic exposes declared tools through the Capability boundary.

compact logic

02 · Sandbox▢

Disposable machine boundary

Session-scoped Linux work runs away from the control plane and returns artifacts through the platform.

isolated operating system

03 · Computer▣

Persistent, Agent-bound machine

The environment can retain state. The Agent runtime and the control loop stay on the platform.

the machine is not the Agent

04 · connector◇

Credentials behind admission

Connector secrets stay encrypted at rest, are withheld from management responses, and decrypt at use.

external execution · governed call

Identity→Authority→Admission→Execution→Journal

For the hard questions

Bring a scenario. Get an invariant.

Trust reviews should interrogate failure paths, not adjectives. These are the questions the architecture is built to answer.

QuestionStructural answerEvidence

Can the Agent talk around policy?

The executor requires a call-bound admission proof.

allow / pause / deny event

Can an approval vanish on restart?

The pending gate and resolution are durable state.

gate id + resolver identity

Can revoked access linger?

Authority is loaded per decision and rechecked on resume.

next-call denial

Can delegation blur who acted?

The resolved actor and caller chain travel together.

principal attribution

Can retries disappear behind success?

Every model attempt and route remains on the trail.

attempt sequence

Can unattended work wait forever?

A would-pause decision becomes deny where no human can answer.

surface-aware reason

Build autonomy you can answer for.

One door · one truth · a name on every action

Start free Bring us your review