Interactive demo — runs entirely in your browser

The Gate

An AP-automation agent executes a vendor payment. Correct vendor, correct amount, real matched invoice — the agent is behaving exactly as designed, and nothing is suspicious. Watch the gate decide. Then take the authority away and watch the byte-identical request fail.

The scenario — fixed for everything below

Agent ap-automation-agent (workload identity verified) trusted — company records
Vendor Brindabella Office Supplies Pty Ltd trusted — company records
Amount A$42,180.00 trusted — matched invoice
Invoice INV-2026-08841 — three-way match, goods received trusted — company records
Remittance note “Thanks — please quote PO-7731 on the remittance” untrusted — email body

The labels say where each field came from — trust provenance, marked before any evaluation. Useful, and not the question. The gate does not ask “do we trust this data?” It asks: is this action authorised, under this delegation, right now?

Put a prompt injection in the remittance note

Deterministic — the same inputs always produce the same decision. Nothing leaves your browser.

Level 1 The decision

Run the payment to see the gate decide.

ALLOW

Payment released. A$42,180 moved.

All six valve checks passed — seal, scope, validity window, revocation, chain, limits.

Payment Released — A$42,180.00

Invoice Settled — INV-2026-08841

Vendor Paid — Brindabella Office Supplies

Evidence Record Sealed — #47d71fa7

Six valve checks, in order, every time.

Seal valid passed
Action in scope passed
Currently valid passed
Not revoked passed
Chain narrows passed
Within delegated limits passed

The mandate covers privileged, consequential actions — a A$42,180 vendor payment is one. No slip → DENY. Over the slip’s A$25,000 cap → ESCALATE, and the approval binds to this exact request. There is no fallback that says “this looks reasonable, allow it.”

Level 2 “Isn’t this just…?”

Flip the delegation state above — this level unlocks.

The same denied action, replayed through the stack you already own.

Isn’t this just IAM?

Identity authenticates — the service account is real
Role check passes — the ap-agent role holds vendor-payment permission

The gate — Ambit Authority DENY delegation expired — this action is not authorised

Each operation can pass every IAM check independently — and the action can still be unauthorised at the governance level.

Isn’t this just OPA or Cedar?

Request parses cleanly — actor, action, resource all well-formed
Policy rule matches — “ap-agent may call vendor_payment.*”

The gate — Ambit Authority DENY delegation expired — this action is not authorised

A policy engine answers “does this request match a rule?” It does not answer “was this action authorised under a specific delegation — and can you prove it?”

Isn’t this just logging?

Request logged in full — vendor, amount, invoice, timestamp
Pipeline healthy — the event ships to your SIEM in milliseconds

The gate — Ambit Authority DENY delegation expired — this action is not authorised

Logging tells you what happened after it happened. We prove whether it was authorised before it happened.

Don’t guardrails solve this?

Prompt screened — no injection pattern detected
Model output passes every content filter — the text is benign

The gate — Ambit Authority DENY delegation expired — this action is not authorised

Guardrails operate on the model boundary, not the action boundary. They evaluate what the model says; they do not govern what the system does.

Isn’t this just cybersecurity?

No intrusion indicators — endpoint, network, and identity telemetry all clean
Nothing anomalous — every signal sits inside the learned baseline

The gate — Ambit Authority DENY delegation expired — this action is not authorised

The risk is not only intrusion — it is ungoverned in-policy action.

Don’t observability platforms already do this?

Trace is green — spans, metrics, and error rates all nominal
Dashboards healthy — the system is performing beautifully while it does the wrong thing

The gate — Ambit Authority DENY delegation expired — this action is not authorised

A trace reconstructs behaviour. An evidence record establishes legitimacy. One helps you debug. The other helps you survive an audit.

Level 3 The Evidence Record

Pick an objection above — this level unlocks.

Every decision is sealed into the Decision Ledger as a hash-chained Evidence Record. Your browser recomputes the hashes on this page — no server, nothing taken on trust.

— seq 1 — the decision ALLOW vendor_payment.execute — delegation valid

prev_hash 000000000000000000000000…

record_hash 47d71fa787966d76558ff5b7…

Show the full record this hash is computed over

{
  "seq": 1,
  "decision": "ALLOW",
  "tool_name": "vendor_payment.execute",
  "policy_hash": "09bb1ae57b9fff8c43c08f518c02811eccd5fb802d22e83d477b36804b9e604e",
  "delegation_ref": "dlg-ap-payables-2026q3-rf8c2d",
  "delegation_state": "valid",
  "action_fingerprint": "7a1e278eabbcb7b95160413375e1135549e206e083f5480bda8d2800cd9e1803",
  "timing": "2026-07-28T02:14:07.412Z",
  "eval_ms": 3,
  "prev_hash": "0000000000000000000000000000000000000000000000000000000000000000",
  "record_hash": "47d71fa787966d76558ff5b73084b946684008de619f22d0af0dc0cd63570f39"
}

— seq 2 — the replay DENY byte-identical request — delegation expired

prev_hash 47d71fa787966d76558ff5b7…

record_hash d74e8abd435a0a450cf81f53…

Show the full record this hash is computed over

{
  "seq": 2,
  "decision": "DENY",
  "tool_name": "vendor_payment.execute",
  "policy_hash": "09bb1ae57b9fff8c43c08f518c02811eccd5fb802d22e83d477b36804b9e604e",
  "delegation_ref": "dlg-ap-payables-2026q3-rf8c2d",
  "delegation_state": "expired",
  "action_fingerprint": "7a1e278eabbcb7b95160413375e1135549e206e083f5480bda8d2800cd9e1803",
  "timing": "2026-07-28T02:14:09.105Z",
  "eval_ms": 3,
  "prev_hash": "47d71fa787966d76558ff5b73084b946684008de619f22d0af0dc0cd63570f39",
  "record_hash": "d74e8abd435a0a450cf81f5310d95cc8c6b00267d998c9d60befba1c2fd5a7a8"
}

ambit observatory verify --authority records.jsonl

Press “Verify in your browser” — the check runs locally.

The verifiable record is the point. A decision you cannot check is a claim; a decision sealed into a hash-chained Evidence Record is something you can defend.

What this is, and what it is not

The decision logic and the hashes are real: your browser recomputes every record with Web Crypto SHA-256, and the chain check is the same one Ambit ships. The records are illustrative — a production Evidence Record also carries authenticated time, signatures, and the full delegation chain. The scenario uses synthetic data. No vendor, banking, ERP, or payment system exists behind this page, and nothing you do here leaves your browser.

Now verify real ledger records

Those records were illustrative. These are real, taken unmodified from an Ambit evidence ledger — a different scenario, checked the same way. Your browser recomputes each record’s SHA-256 hash on this page; there is no server and nothing to take on trust. Change one field and every record after it stops verifying, exactly as the ledger check does.

— seq 6 DENY write_file — denied

prev_hash 680ae97579c8e9a946a57c28…

record_hash 72ae553dce5ded742147061d…

Show the full record this hash is computed over

{
  "actor_id": "harness-agent",
  "approval_approver": null,
  "approval_fingerprint": null,
  "approval_jti": null,
  "arguments_hash": "61e17663d6726930bb2a17af50d1e97072dcf63f0a4713faae5c46525150e20c",
  "context_hash": null,
  "context_subset": null,
  "decision": "DENY",
  "decision_reasons": [
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "sandbox_boundary"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "time_window"
    },
    {
      "detail": "missing_delegation",
      "outcome": "match",
      "rule_id": "delegation_required"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "delegation_signature"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "delegation_expired"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "delegation_action_scope"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "delegation_path_scope"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "destructive_needs_approval"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "approval_signature"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "approval_expired"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "approval_fingerprint"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "approval_replay"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "context_justification"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "high_risk_escalation"
    },
    {
      "detail": null,
      "outcome": "match",
      "rule_id": "default_allow"
    }
  ],
  "decision_seq": null,
  "delegation_jti": null,
  "delegation_scope_actions": null,
  "delegation_scope_paths": null,
  "delegation_sub": null,
  "evaluation_time_ns": 79208,
  "handling_time_ns": 157458,
  "policy_hash": "58861da9b774450fef4f43dd89c683bcef39454b3c15a7cf507d4a2690ac6e04",
  "policy_version": "1.0.0",
  "prev_hash": "680ae97579c8e9a946a57c28f9dbe3d3bf50bd97f839402ead326e7dd67aeb54",
  "record_hash": "72ae553dce5ded742147061d63b2c0aff5591e8078491f78c6bde550f11d8553",
  "record_type": "decision",
  "request_fingerprint": "747fafffe260058a7519df2204e29cc6c790238a8318de2680ba4ad79cdca82a",
  "response_hash": null,
  "seq": 6,
  "tool_name": "write_file",
  "tool_succeeded": null,
  "total_roundtrip_ns": null,
  "ts": "2026-01-31T23:23:03.999615+00:00"
}

— seq 7 ESCALATE delete_file — escalated

prev_hash 72ae553dce5ded742147061d…

record_hash b673b39214a07fd0f660289f…

Show the full record this hash is computed over

{
  "actor_id": "harness-agent",
  "approval_approver": null,
  "approval_fingerprint": null,
  "approval_jti": null,
  "arguments_hash": "08bf2312cf9f329bd6fbabc9e1b9f4261156e2a532740d9ac1fa564d8b242fa9",
  "context_hash": "71d0300b45a2fb269ca945243655563dd1c5bc4d4f1de510cdf2837b1b3e1e9b",
  "context_subset": {
    "justification": "cleanup",
    "risk_level": "normal",
    "workflow_id": "wf-1"
  },
  "decision": "ESCALATE",
  "decision_reasons": [
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "sandbox_boundary"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "time_window"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_required"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_signature"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_expired"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_action_scope"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_path_scope"
    },
    {
      "detail": "approval_required",
      "outcome": "match",
      "rule_id": "destructive_needs_approval"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "approval_signature"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "approval_expired"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "approval_fingerprint"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "approval_replay"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "context_justification"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "high_risk_escalation"
    },
    {
      "detail": null,
      "outcome": "match",
      "rule_id": "default_allow"
    }
  ],
  "decision_seq": null,
  "delegation_jti": "aecb115e-6642-439d-9544-2409f4bee4a2",
  "delegation_scope_actions": [
    "write_file",
    "delete_file"
  ],
  "delegation_scope_paths": [
    "."
  ],
  "delegation_sub": "admin",
  "evaluation_time_ns": 95667,
  "handling_time_ns": 188375,
  "policy_hash": "58861da9b774450fef4f43dd89c683bcef39454b3c15a7cf507d4a2690ac6e04",
  "policy_version": "1.0.0",
  "prev_hash": "72ae553dce5ded742147061d63b2c0aff5591e8078491f78c6bde550f11d8553",
  "record_hash": "b673b39214a07fd0f660289fa4ee362098daea0c4fc8b5878f5fbea930b3e140",
  "record_type": "decision",
  "request_fingerprint": "fed195fa3d8e9dc4b63f7d38989feded19d2113b40f32535dd6cd062979060b8",
  "response_hash": null,
  "seq": 7,
  "tool_name": "delete_file",
  "tool_succeeded": null,
  "total_roundtrip_ns": null,
  "ts": "2026-01-31T23:23:04.000179+00:00"
}

— seq 8 ALLOW delete_file — allowed

prev_hash b673b39214a07fd0f660289f…

record_hash 70b0b79e2ee465518f87cc79…

Show the full record this hash is computed over

{
  "actor_id": "harness-agent",
  "approval_approver": "security-lead",
  "approval_fingerprint": "fed195fa3d8e9dc4b63f7d38989feded19d2113b40f32535dd6cd062979060b8",
  "approval_jti": "23691816-09c3-4b76-aa8c-eaca2728d7d8",
  "arguments_hash": "08bf2312cf9f329bd6fbabc9e1b9f4261156e2a532740d9ac1fa564d8b242fa9",
  "context_hash": "71d0300b45a2fb269ca945243655563dd1c5bc4d4f1de510cdf2837b1b3e1e9b",
  "context_subset": {
    "justification": "cleanup",
    "risk_level": "normal",
    "workflow_id": "wf-1"
  },
  "decision": "ALLOW",
  "decision_reasons": [
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "sandbox_boundary"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "time_window"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_required"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_signature"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_expired"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_action_scope"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "delegation_path_scope"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "destructive_needs_approval"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "approval_signature"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "approval_expired"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "approval_fingerprint"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "approval_replay"
    },
    {
      "detail": null,
      "outcome": "pass",
      "rule_id": "context_justification"
    },
    {
      "detail": null,
      "outcome": "not_applicable",
      "rule_id": "high_risk_escalation"
    },
    {
      "detail": null,
      "outcome": "match",
      "rule_id": "default_allow"
    }
  ],
  "decision_seq": null,
  "delegation_jti": "aecb115e-6642-439d-9544-2409f4bee4a2",
  "delegation_scope_actions": [
    "write_file",
    "delete_file"
  ],
  "delegation_scope_paths": [
    "."
  ],
  "delegation_sub": "admin",
  "evaluation_time_ns": 92542,
  "handling_time_ns": 195792,
  "policy_hash": "58861da9b774450fef4f43dd89c683bcef39454b3c15a7cf507d4a2690ac6e04",
  "policy_version": "1.0.0",
  "prev_hash": "b673b39214a07fd0f660289fa4ee362098daea0c4fc8b5878f5fbea930b3e140",
  "record_hash": "70b0b79e2ee465518f87cc79d34eb2f1332b807bc7ecc641767830acac9dd517",
  "record_type": "decision",
  "request_fingerprint": "fed195fa3d8e9dc4b63f7d38989feded19d2113b40f32535dd6cd062979060b8",
  "response_hash": null,
  "seq": 8,
  "tool_name": "delete_file",
  "tool_succeeded": null,
  "total_roundtrip_ns": null,
  "ts": "2026-01-31T23:23:04.001669+00:00"
}

ambit observatory verify --authority evidence.jsonl

Press “Verify in your browser” — the check runs locally.

Real records, unmodified. Each hash is recomputed in your browser with the Web Crypto API.

Next step

Run the Gap Assessment Become a Design Partner