Agent Trust Access Governance
Decide what an agent may touch, at the resolution of the individual action rather than the system.
What it does
Capabilities
- Role and attribute rules evaluated with agent, user, tenant, data, tool, environment, time, risk and declared purpose in context
- Action-level permissions, so reading a supplier and changing its bank details are separate grants
- Five sensitive action classes from read through draft, reversible execution, human approval and dual approval
- Just-in-time privileges that are issued for one action and expire rather than accumulating
- A credential broker that issues scoped, short-lived secrets on request, so an agent never holds a permanent key
What it leaves behind
Evidence produced
- A permission inventory showing where an agent exceeds its purpose
- An expiry on every elevated grant
- A credential ledger: which agent held what, against which system, and when it lapsed
Five classes of action
The level is a property of the action, not of the agent. The same agent reads a supplier at level 0 and changes its banking details at level 4.
- Level 0Read
Low-risk retrieval that changes nothing.
Allowed and logged.
Read a supplier record · Search ticket history
- Level 1Draft
The agent prepares output a human will act on.
Allowed and logged; nothing leaves the system.
Draft a purchase order · Compose a reply for review
- Level 2Execute, low risk
A real action, reversible without material harm.
Allowed under policy, with the decision recorded.
Send a purchase order · Create a contact
- Level 3Sensitive
Consequential, and hard to unwind once done.
Human approval required before execution.
Issue a refund above threshold · Export a customer list
- Level 4Critical
Irreversible, or an obvious target for fraud.
Two-person approval, or prohibited outright.
Change supplier banking details · Initiate a payout · Run a shell command
Specification
Where this is specified
5 blueprint pages carry the specification for this module.
Authorization & Policy Engine
This is the heart of the product. The engine evaluates an agent’s identity, delegated authority, requested action, resource, context and risk to produce an explainable decision. Policies should be deterministic, testable, versioned and easy enough for security teams to operate without writing application code.
CORE IP →
Agent Secrets Vault
The safest secret is one the model never sees. Agent Trust Cloud should broker privileged actions so an agent can request an operation without receiving the underlying API key, password or signing secret. This lowers credential leakage risk and makes revocation easier.
DESIGN GOAL →
Tool & API Controls
Agents gain power through tools. Agent Trust Cloud must inventory tool capabilities and govern individual operations, not just decide whether an agent may access an application. Read customer vs. delete customer are radically different authorities.
AUTHORITY MODEL →
Human-in-the-Loop Approvals
Human approval is the bridge between autonomous speed and accountable high-impact actions. The workflow should provide the approver enough context to make a decision quickly without forcing them to open several systems.
UX RULE →
Agent-to-Agent Delegation
Multi-agent systems introduce delegated authority chains. Agent B should not gain more authority merely because Agent A asked it to perform a task. The platform needs explicit delegation semantics, depth limits and evidence.
CORE RULE →
13 modules and services make up the platform. See how they fit together.