Access is not authorisation
Governance infrastructure for autonomous systems
Security checks the actor. Governance checks the action.
The Missing Authority Layer
Traditional controls were designed for humans who choose their own actions. Autonomous systems broke that assumption.
An agent fulfils a support request by sending claimant data to a partner.
Valid credentials. Correct role. Tool access granted. Every security check passes.
The data leaves. A post-hoc review discovers the exposure.
No system proves this action was authorised, or under what policy or delegation.
Traditional controls govern access. They do not govern delegated action.
From Intent to Evidence Record
Every consequential action passes through a single decision point — and produces a verifiable record. Execution proceeds only after explicit ALLOW. ALLOW is never implicit.
Intends to perform a consequential action
Evaluates delegation and policy; returns ALLOW, DENY, or ESCALATE
Append-only decision record with configurable integrity protections
Explains what happened and which policies applied
Traditional controls answer a different question
Identity, roles, permissions, and gateways govern access. Logs record what happened after the fact. None decide whether a specific action was authorised. Autonomous systems broke the assumption that a human selects every consequential action.
What the stack can tell you
What it cannot tell you
Governance must live on the execution path
If governance is optional, retrospective, or outside the consequence path, it cannot decide actions before they commit. The missing layer has to sit where autonomous actions actually execute.
One Boundary. Any Agent.
Authority decides before execution.
PrimaryAmbit Authority
Renders a governance decision — ALLOW, DENY, or ESCALATE — before any autonomous action executes.
One enforcement point — independent of agent runtime, model provider, and orchestration framework. Execution is routed through it, or it does not happen.
Authority decides. Observatory makes those decisions provable.
AssuranceAmbit Observatory
Derives explanations from governance decisions — which policies applied, what was decided, and why.
Governed by fixed invariants
Every decision is bound by constitutional invariants: no action without evaluation, no evaluation without delegation, no decision without evidence. Governance is specified up front, not improvised after the fact.