The control layer between autonomous agents and tools

Autonomy
needs receipts.

Discover tools. Present scoped authority. Invoke within budget. Return signed proof.

A governed MCP trust plane where every autonomous action can be authorized, metered, receipted, audited, and revoked.

Enter as an agent Inspect the proof

Operator-issued access · closed-loop credits · not payment rails

00 / Thesis

Agent intent is not evidence.
A receipt is.

Agents need room to act. Operators need a boundary they can verify. Permit sits between intent and execution so authority is explicit before a tool runs and evidence comes back after it.

The goal is not to slow autonomy down. It is to make autonomy legible enough to trust.

  1. Before Know the boundary

    Discover the tool, budget, scope, expiry, and current runtime.

  2. During Enforce the authority

    Validate the permit before invocation and meter the call once.

  3. After Bring back proof

    Return a signed receipt linked to ledger and audit evidence.

01 / Protocol

One governed path from intent to evidence.

The interface is the protocol: every step is inspectable by agents and accountable to their operators.

  1. 01Discover
  2. 02Authenticate
  3. 03Authorize
  4. 04Invoke
  5. 05Meter
  6. 06Receipt
  7. 07Audit
  8. 08Govern

02 / Tested proof flow

One call. One charge. One receipt.

The repository dogfood flow proves success, replay safety, missing permit rejection, and out-of-scope denial. Values shown here are illustrative; run the proof for signed output. For remote tools, the gateway does not claim exactly-once side effects unless the upstream honors the forwarded idempotency key.

1×gateway dispatch
1×wallet debit
1×signed receipt
First request success
tool
partner.notes.write
idempotency
dogfood-invoke-1
charged
2.0 credits
receipt
rcpt-c3bc…e5a

Dispatched and receipted at the gateway

Replay · same key same receipt
tool
not re-executed
idempotency
dogfood-invoke-1
new charge
0 credits
receipt
rcpt-c3bc…e5a

No second debit

Outside scope denied
tool
partner.notes.admin
outcome
denied
reason
permit_tool_not_allowed
charged
0 credits

Authority enforced

 make dogfood-trust-plane
Inspect the reproducible proof No permit → permit_required

03 / First deployment

Start with one tool, not a platform migration.

Bring one internal MCP tool. Issue one wallet-scoped permit. Walk permit → invoke → charge → receipt → replay → deny. Stop there until the loop is trusted in your stack.

Run the governed pilot Design partner guide

04 / Honest boundary

What this is not.

  • Production settlement or payments rails
  • Compliance-grade ledger storage
  • Enterprise IAM or secrets replacement
  • Universal governance across every agent framework