Authority before action
Govern the action,not the model.
Introducing RotaGrant
An agent’s capability is not its permission. Set explicit limits. Check the action against them. Keep the reason.
01Before execution
One request. Nine checks. An explicit outcome.
Synthetic exampleNot connected to production
settle_payment · EUR 60,000
exhausted01 / Authority
A grant exists.
The agent presents a grant that names it and covers payment settlement, signed for by an accountable person. Passing here says only that some authority exists; every later check can still stop the action.
02 / Status
The grant is active.
It has not been revoked, suspended, or left waiting for a second approver. A grant that is not active stops the sequence here, before anything expensive runs.
03 / Window
The request is in time.
The call falls inside the grant's validity window. Authority expires: a request after the window is refused even if everything else would pass.
04 / Scope
The action is in scope.
settle_payment is among the actions this grant permits. Scope is checked before any amount, so an out-of-scope action never reaches the ceiling.
05 / Clean context
The context is clean, where the grant requires it.
This grant requires a context free of untrusted input. In this example nothing the agent read was tainted, so the check passes. Had it read an untrusted instruction first, the outcome would be gated, not allowed.
06 / Bounds
The individual limit is sufficient.
EUR 60,000 is inside the agent's own EUR 100,000 ceiling for a single action. That says nothing yet about whether the budget it draws on can fund it.
07 / Policy
The policy on the grant permits it.
The grant's policy, evaluated for this one action, returns permit. A forbid here would be a deny; a policy that cannot be evaluated is a review, never a silent pass.
08 / Budget
The authority stops here.
The request fits the agent's own limit but exceeds the EUR 45,000 remaining on the parent grant it draws from. Spending against a child debits every ancestor, so a tree cannot fund what one branch could. The outcome is exhausted, the action is not executed, and review is not reached.
09 / Review
Not reached is an explicit state.
The budget check already stopped the action, so the review gate did not run. The record says so rather than leaving it blank: not reached is neither a pass nor a failure.
- Requested amount
- EUR60,000
- Agent’s action ceiling
- EUR100,000
- Parent budget remaining
- EUR45,000
- Refused at
- 08 · budget
- Decision outcome
- exhausted
Select a check to inspect its reason.Inspection does not change the decision.
The example above is invented to show the shape. The real thing is a signed record from the running demo: verify a real refusal in your browser. Nothing is uploaded.
02What this is
Agents have identity. They need authority.
- IAM
- tells you who the agent is.
- Evaluation
- tells you whether the model is capable.
- Observability
- tells you what happened.
- RotaGrant
- determines what the agent is allowed to do, before it does it — and the answer is one of six, not two:
allow deny exhausted
gated review_sync review_async
Every consequential action passes through the same nine checks before execution, in the same order, with the budget debited last so an action refused by policy costs nothing. How it works.
03Deployment
The boundary is yours.
So is the deployment.
Keep governance with the systems it controls, inside your own environment: your VPC, your data centre, or airgapped.
RotaGrant does not need your prompts, payloads or business data, and it calls no model on any path.
Read the architecture- Runs in your environment
- No payloads sent to Rotascale
- Evidence you can verify without trusting us
The outbound connections a deployment could make are enumerable and off by default; airgapped mode refuses every one of them and says which evidence property that costs. How it deploys.
04Independence
Your governance layer shouldn’t belong to your model vendor.
One governance layer across every agent runtime. A hyperscaler will govern its own estate well and only its own, so an independent layer spanning several runtimes is worth more with each entrant, not less.
- OpenAI
- Anthropic
- Google Gemini
- AWS Bedrock
- LangChain
- LangGraph
- MCP
- Google ADK
- CrewAI
- AutoGen
- AWS Strands
05Rollout
Start by observing. Enforce when you’re ready.
Enforcement is a mode on a grant and it moves one rung at a time:
observe, shadow, canary,
enforce. The first two refuse nothing and cost nothing.
06Proof
Don’t trust our claims. Check them.
- Live agents
- Agents run on the demo daily, ask for authority and get refused. Nothing on it was seeded. observed →
- Open specification
- Versioned and permissively licensed, so a competitor’s engine could claim conformance to it. observed →
- Verifiable artefacts
- Check a signed pack in your own browser. Nothing is uploaded. observed →
- Published failures
- We attack our own detectors and publish the cells we fail, classified as defect or residual. observed →
- Adversarial assurance
- A search over every identifier and mutation the regime activates, run against our own detector, with a denominator rather than an assurance that we tried. observed →
observed the link goes to the thing itself, not to a description of it. asserted we are telling you, and there is nothing you can verify from outside. The product draws this line in every record it produces, so it would be strange to abandon it here.
07Writing
We argue in public
What the regulations actually say, where our own controls fail, and the engineering underneath. Written to be disagreed with rather than to rank for anything.
08Start
Put one consequential agent under governance.
Deploy RotaGrant around one real workflow and see what would have been allowed, refused or escalated over your own traffic, before anything is blocked.
Newsletter
Occasional, and worth the inbox space.
Notes on agent governance, what the regulations actually say, and what we are building. Roughly monthly. Double opt-in, no tracking, and unsubscribing takes one click and asks you nothing.
RSS works too and needs nothing from you · What happens to your address