Identity and authorization for AI agents.

Each operator holds an HMAC key Hash-based Message Authentication Code. A signature computed from the message and a secret key only the operator holds. The gateway recomputes it to verify the message wasn't sent by anyone else. . Messages reach the gateway with a signature, a session id Stable identifier for a chat thread or call session — for example, a Slack channel id or a Discord DM id. Bound to the operator at the first verified message. , and an active-message id Per-message id the gateway hands to the agent. Tool calls must echo it back so the gateway can match the policy decision to the originating message. . The gateway verifies the signature, refuses unsigned or replayed Re-sending an old, valid message to make the agent act again. Rejected by the gateway via a nonce TTL — each message id is single-use within a window. messages, and forwards only the verified ones to the agent.

Tool calls return through the gateway with the same id. Three checks decide whether each call runs — signature valid, session bound to the same operator, action on the role allow-list List of (role, action) pairs the gateway is permitted to run. Held off-host in Postgres. The agent has no credentials to read or modify it. . Policy lives in a separate database the agent has no credentials for. Whatever the agent rewrites in its own files, the gate does not move.

Every accepted call is sealed with a keyed image watermark Discrete Wavelet Transform plus Singular Value Decomposition — a keyed image-watermarking scheme. The seal is computed from the operator's HMAC, so a valid one cannot be produced without their secret. and dropped into an append-only audit log Database role with no UPDATE or DELETE on the audit_log table. New rows can be added, but rows already written cannot be modified or removed — including by us. . The receipt can be verified later without contacting the gateway. History cannot be edited, including by us.