Who is it?
Necessary for attribution. Insufficient for authority.
ActionGate · Flagship control plane
AI agents can recommend anything.
ActionGate controls what they are allowed to do.
ActionGate puts a deterministic machine-authority boundary between agent intent and consequential execution. It evaluates the exact requested action against delegated authority, policy, revocation, separation of duties, and required Consequence Capital before a narrow Action Permit can exist. See where delegated authority comes from
ACTIONGATE / SYNTHETICREQUEST AG-74C1
SEMANTIC ACTIONElevate production role
Principal: deploy-agent-07 · target: production billing service · duration requested: 45m
IDENTITYVERIFIED
DELEGATIONFOUND
SCOPEDEPLOY ONLY
DURATIONEXCEEDS 15M
REVOCATIONCLEAR
CONSEQUENCEBOUNDED
DETERMINISTIC DECISIONNARROW
Permit may authorize the deployment role for 15 minutes. Requested 45-minute elevation is outside delegated authority.
Synthetic product illustration. No customer environment, production action, external proof, or realized customer result is represented.
Product definition
What is ActionGate?
ActionGate is a deterministic authorization control plane for consequential AI-agent and machine actions. It does not ask whether an agent sounds confident, whether a model believes an action is safe, or whether a credential can technically reach the target. It asks whether this exact action is inside explicitly delegated authority right now, under current policy and revocation state, with every required boundary satisfied.
The control gap
01 / WHY ACTIONGATE
Most controls answer a neighboring question.
Identity establishes who or what is acting. Credentials establish technical reach. Guardrails influence model behavior. Workflow tools coordinate steps. Audit records what was observed. ActionGate owns the narrower question that becomes critical once software can create real-world consequence: may this machine exercise this exact power now?
What can it reach?
Capability is not permission to use that capability.
How should it behave?
Probabilistic behavior controls do not issue institutional power.
May this happen?
Deterministic authorization for the exact requested consequence.
Decision anatomy
02 / EXACT REQUEST
An ActionGate decision is smaller than the agent.
The agent can reason broadly. The permit cannot. ActionGate collapses a semantic request into a bounded authorization decision tied to an exact subject, action, target, scope, time window, consequence boundary, and evidence lineage.
- 01Semantic request
Normalize what the machine intends to cause, not merely which API endpoint it called.
- 02Authority lineage
Resolve the principal, delegation source, scope, expiry, recursive delegation, and current revocation state.
- 03Deterministic policy
Evaluate exact constraints, separation of duties, approvals, limits, target boundaries, and required consequence capacity.
- 04Decision
Permit, narrow, deny, or require human authority. The model does not vote on the result.
- 05Action Permit
If allowed, issue a narrow, short-lived artifact bound to the authorized action rather than a broad ambient capability.
- 06Evidence handoff
Bind request, authority, decision, permit, execution evidence, and later consequence proof into attributable lineage.
Four outcomes
03 / DECISION
Not every valid request should become a binary yes or no.
Inside authority.
The exact action is allowed under current delegation, policy, revocation, and required consequence conditions.
Less power than requested.
ActionGate can reduce duration, amount, target, scope, rail, resource, or other dimensions to the authorized boundary.
A machine cannot self-escalate.
Requests requiring new power can be routed to a human or external authority source rather than inferred from urgency.
Outside the constitution.
Expired, revoked, prohibited, unreserved, structurally invalid, or otherwise unauthorized actions fail closed.
Where the boundary matters
04 / CONSEQUENCE
Start where a wrong permission becomes expensive.
ActionGate is designed for workflows where the cost of false authority is materially different from the cost of a bad answer. The same authorization primitive can govern very different consequences without pretending those domains are identical.
Agentic payments
Amount, beneficiary, payment rail, timing, approvals, reserve conditions, and settlement-bound execution.
Privileged infrastructure
Role elevation, production changes, destructive operations, secret access, recovery, and bounded maintenance windows.
Enterprise SaaS
Administrative changes, record mutation, approvals, sensitive exports, account controls, and business commitments.
Cross-enterprise actions
Authority that must remain attributable when machines act across organizational, contractual, or execution boundaries.
Designed to sit between, not replace
Keep your identity, models, workflows, and execution systems. Add an authority boundary.
ActionGate is designed as an independent control plane. Identity systems can continue authenticating principals. Agent frameworks can continue planning. Policy sources can continue expressing institutional rules. Credential brokers and execution systems can continue doing their specialized work. ActionGate binds those facts to an exact authorization decision without pretending one neighboring system should become the whole constitution.
01Agent / workflowintent
02Identity + delegated authorityprincipal + power
03ActionGatedeterministic decision
04Execution boundarypermit-bound capability
05Evidence + consequenceattributable outcome
Action Permit lifecycle
05 / BOUNDED POWER
The permission should be narrower than the capability.
- Why issue an Action Permit instead of approving the agent?
- An agent is a broad actor with changing context, tools, and goals. An Action Permit is deliberately smaller. It binds one authorized subject to one action, one target, one bounded scope, and one short time window. Approving the agent would turn a specific institutional decision into ambient power; issuing an Action Permit preserves the difference between a capable machine and an authorized consequence.
- What happens before an Action Permit exists?
- ActionGate first resolves the semantic action being requested, the current delegated-authority lineage, policy constraints, revocation state, separation-of-duties conditions, and any consequence capacity that must exist before execution. Missing authority is not repaired by a credential, a workflow state, a model explanation, or the fact that a similar action succeeded previously. The Action Permit exists only after the current request is inside the current authority boundary.
- Why should the permit expire quickly?
- Machine context changes faster than traditional standing access assumptions. A short-lived Action Permit reduces the distance between the decision and the consequence it authorizes. If the target, amount, scope, authority source, revocation state, or other governed fact changes materially, the machine should return to the decision boundary rather than continue acting under an old broad approval.
- How does narrowing preserve useful autonomy?
- Fail-closed governance does not require every imperfect request to stop. When policy and delegated authority support a smaller safe action, ActionGate can authorize that smaller action instead. A 45-minute role elevation can become 15 minutes; a broad resource set can become a named target; a requested amount can be constrained to an authorized ceiling. The resulting Action Permit reflects the power that was actually delegated, not the power the agent happened to request.
- When do credentials enter the chain?
- After authority. The execution layer may materialize a credential or capability that is bound to the Action Permit and usable only for the permitted operation. This ordering matters because possession of a token, API key, wallet, cloud role, or service account must never be interpreted as proof that the machine had institutional authority to use it. Capability follows the decision instead of impersonating the decision.
- What survives after the permit is spent or expires?
- The broad execution capability should not. The attributable lineage should. StableMind can preserve the request, authority facts, deterministic decision, Action Permit identity, execution evidence, receipts, and later consequence evidence needed to explain what happened. That evidence supports investigation and stronger proof, but it never retroactively grants authority to an action that was unauthorized before execution.
Operating model
06 / IN PRACTICE
A control plane should become more useful as the workflow becomes more real.
Choose a workflow the organization will not delegate blindly today. The refusal exposes the missing authority facts more clearly than a generic automation inventory does.
Customer-controlled shadow mode can compare what an agent wants to do with what the current authority model would permit, without granting downstream execution power.
The useful output is not simply “blocked.” It is the difference between requested power and delegated power: missing scope, excessive duration, wrong target, absent approval, expired authority, or another exact constraint.
When a workflow is eventually activated under the production program, the Action Permit should remain exact, revocable, attributable, and limited to the smallest consequence the organization has actually authorized.
Guardian and revocation paths remain separate from the agent that requested the action, so the system can remove or narrow machine power without depending on the machine to agree with the intervention.
Broader automation should follow observed authority coverage, decision quality, intervention readiness, and attributable execution evidence. A successful demo, integration, or commercial purchase does not expand machine authority.
Non-negotiable properties
07 / CONSTITUTION
The control plane is useful only if its boundaries survive pressure.
Model reasoning may shape a request; the final authority decision is governed by explicit machine-evaluable facts and policy.
No credential, urgency signal, subscription, integration, or confident model output silently fills an absent delegation.
Permits bind an authorized consequence instead of turning one approval into ambient machine power. Execution Fabric then binds technical capability to that permit.
Authority that can be granted must also be capable of becoming unusable before a later prohibited action completes.
Execution capability should materialize after permission exists, not serve as evidence that permission must have existed.
Observing or proving what happened cannot retroactively legitimize an action that lacked authority before execution.
Evaluator questions
08 / BUYER CLARITY
Questions ActionGate is built to make answerable.
- How is AI agent authorization different from authentication?
- Authentication establishes identity. ActionGate evaluates whether that identified machine has delegated authority for the exact consequential action it is requesting.
- Does ActionGate replace IAM or secrets management?
- No. Those systems remain valuable. ActionGate consumes relevant identity, delegation, policy, and execution facts while preserving the distinction between technical access and institutional authority.
- Can an agent increase its own authority?
- No. A machine request can ask for broader power, but ActionGate cannot manufacture the missing delegation. New authority must come from a valid authority source.
- What happens when only part of a request is authorized?
- The decision may narrow the request to the authorized boundary, such as reducing time, amount, scope, target, or another governed dimension.
- Does a StableMind account create machine authority?
- No. Website access, signup, subscription, commercial entitlement, and integration state create zero downstream action authority.
Interactive evaluation
See ActionGate change when the facts change.
The Authority Lab ↗ is a synthetic browser-local demonstration of PERMIT, NARROW, HUMAN_AUTHORITY, and DENY outcomes. It creates no real permit or execution.
Public truth boundary
Product depth is not production proof.
This page describes StableMind architecture and product behavior. Its examples are synthetic. It does not claim a named legal customer, a live governed customer action, external production proof, recognized revenue, or realized customer value.
Read the Public Truth ContractStart with ActionGate
Begin with the action you would refuse to let an AI agent perform blindly.
That is the shortest path into machine authority: define the consequential action, expose the authority boundary, then move toward synthetic evaluation and customer-controlled shadow mode. SIO19 introduces the commercial account and organization boundary. Deployment still requires a configured external identity provider, and the resulting account creates no permit, credential, delegation, or machine authority.
website_session_creates_authority=false
After the decision
Inspect what proof can establish.
ActionGate decides before action. The Proof Explorer follows the later request, permit, executor receipt, verifier observation, and Proof of Consequence without letting evidence grant authority.