Agent Integration Gateway
Protocol-compatible MCP stdio operation using version 2025-06-18. Only atg.evaluate_action is exposed. There are no MCP execution, policy-administration, revocation or emergency-control tools.
Controlled companion demonstration · 20 October 2026
Genuine Microsoft identity. Separate synthetic purchase authority.
One controlled non-production Entra reviewer sign-in was followed by separate manual approval and execution of a synthetic £4,000 purchase. Identity admission granted zero purchasing authority. No real purchase or payment occurred; fixture keys and fixed action time remain demonstration limits. This separate companion does not qualify the operational record candidate or add Microsoft login to local.7.
Review the result and proposed £1,500 evaluation →Latest update · 18 October 2026
Operational plugin and Microsoft Entra integration.
A new review candidate adds persistent record updates, exact-action human approval and signed outcomes. Microsoft application setup and admin consent are complete; MFA policy and a live ATG sign-in remain to be verified. The evaluation material below retains its original synthetic scope.
See the latest implementation and verification status →Local synthetic prototype · evidence controlled
Exact Action Trust Gateway for AI agents.
Agent Trust Gate™ checks whether an AI agent’s exact proposed action remains within a human-authorised mandate at the point where action authority would be granted. It returns deterministic evidence and, only where permitted, a tightly bound one-use GatePass.
ATG does not decide whether an action is commercially wise, beneficial or correct. It verifies declared authority, exact-action integrity, policy conditions and lifecycle state.
Review verified evidence →Install the local plugin →Try the ATG Challenge →Open repositoryDiscuss a controlled pilot
Local-onlySynthetic evidenceNo live executionNot production ready
Agent Integration GatewayLocal MCP over stdio; exactly one evaluation tool.
Exact Action Trust GatewayCanonical action, mandate and one-use GatePass controls.
Business AssurancePolicy, Shadow Mode, exposure, stop and recovery evidence.
Customer Trust EvidenceNon-authorising receipts, Coverage Map and reproducible metrics.
Standalone plugin · local evaluation edition
Bring ATG into your existing agent project.
Install one Node.js package to evaluate exact actions through an SDK or local MCP. It reuses the ATG authority core and includes a gated synthetic execution example. The purchase-order approval carries signed business state, checked again at synthetic commit and during reconciliation. Changed state requires fresh approval; uncertainty holds further work.
local.4 also includes optional Node 24+ shared-worker evaluation: separate processes, local SQLite, one machine. Legacy SDK/CLI/MCP remain Node 20 compatible. Start with one bounded workflow and inspect the decision evidence. Shadow observation grants no authority. A live integration requires a host-owned execution adapter and separately engineered trust infrastructure.
Local.7 · evaluation release
Reviewed fixes. Explicit limits.
The original Windows incident remains unattributed. A matching EPERM atomic-replacement mechanism was reproduced with an owned open file handle; the original OS error and locking process are unknown. A separate cleanup defect was fixed: colliding temporary files are preserved and native errors remain available in Error.cause. Denied writes still fail closed and preserve reservations. No automatic retry or permission weakening was added; passing reruns do not clear the incident.
The local.7 evaluation release contains Mission 04 signing, POSIX durable-state creation and durable-write cleanup/error-diagnostic fixes. Published local.5 is unchanged and lacks these fixes. Local records are not encrypted by ATG; Windows requires separately provisioned NTFS permissions. POSIX runtime verification was not performed for this candidate; its POSIX permission test was skipped on Windows.
Local synthetic authority and evidence, fixture keys and a fixed reference clock. No live purchasing or payment, production-readiness claim, self-learning or automatic authority expansion.
The point-of-action gap
Legitimate instructions can still become a changed action.
An agent may start with a valid task and later propose a different supplier, quantity, price, account, destination, resource or timing. Model confidence does not create authority.
The ATG question
Does the evidence authorise this agent to perform this exact action, here and now, within these limits?
Verify authority before AI acts. No verified standing. No current authority. No exact-action proof. No valid GatePass. No action.
One coherent architecture
Integrate, decide, assure.
The three layers share the same exact-action authority core. The integration boundary does not create authority; the trust gate does not execute; assurance artefacts do not become permission.
Exact Action Trust Gateway
Checks registered tool/schema identity, agent standing, human mandate, policy, freshness and lifecycle state. GatePass remains exact-action-bound, expiring, revocable and one-use.
Business Assurance & Customer Trust
Adds buyer policy contracts, deterministic risk tiers, Shadow Mode, aggregate exposure, emergency stop, recovery, Customer Trust Receipts and an evidence-backed Coverage Map.
How ATG works
Deterministic controls before permission.
All current public scenarios are local and synthetic. One frozen in-process synthetic adapter can acknowledge one permitted demonstration action; it makes no real order or payment.
01
Mandate
A human defines bounded authority and evidence requirements.
02
Propose
The agent submits one exact canonical action.
03
Evaluate
Standing, mandate, policy, evidence and lifecycle checks run.
04
Verdict
ACCEPT, REJECT, REFER, or revocation prevents progression.
05
Evidence
Decision and any synthetic execution receipt remain separate.
ACCEPTAll mandatory checks pass; enforced mode may issue a one-use GatePass.
REJECTThe action is invalid, prohibited, altered, unauthorised or unverifiable.
REFERNo authority is granted; human review or additional evidence is required.
REVOKEInternal lifecycle control invalidates unconsumed authority; it does not reverse execution.
Shadow Mode: runs the same proposed-verdict path but issues no GatePass, mutates no enforcement state and grants no execution authority.
P3-M161 verified demonstration
Ten purchasing lifecycle cases.
Observed in the deterministic ten-case synthetic demonstration. The outcomes below are fixed local evidence, not customer, production or statistical results.
| # | Case | Verdict | GatePass | Execution evidence |
|---|---|---|---|---|
| 1 | Exact authorised purchase | ACCEPT | Issued and consumed | Synthetic acknowledgement |
| 2 | Quantity substitution | REJECT | None | None |
| 3 | Supplier substitution | REJECT | None | None |
| 4 | Price-band breach | REFER | None | Human review required |
| 5 | GatePass reuse | REJECT | Already consumed | Blocked |
| 6 | GatePass revocation | REJECT | Revoked | Blocked |
| 7 | Shadow Mode | would ACCEPT | None | None |
| 8 | Aggregate ceiling | REFER | None for breaching action | None |
| 9 | Authority expansion | REJECT | None | None |
| 10 | Emergency/recovery | REJECT | Progression blocked | No automatic retry |
P3-M162 Customer Trust Evidence
Verify evidence without turning it into authority.
Customer Trust Receipts are digest-bound summaries derived from verified local evidence. They are non-authorising and cannot reserve, execute, retry, revoke or act as GatePasses. Decision and execution receipts remain separate.
- Tampered, missing, substituted or mismatched evidence fails verification.
- The verifier checks canonical bundle content and locked source evidence.
- Reviewer-readable Markdown and machine-readable JSON derive from the same evidence.
- Evidence says what was demonstrated and keeps absences visible.
npm run evidence:m162 -- --output-dir examples/p3-m162
npm run verify:m162 -- --input examples/p3-m162/evidence-bundle.json
npm run test:customer-trust-evidence
npm run test:m162-regression
npm run verify:m162 -- --input examples/p3-m162/evidence-bundle.json
npm run test:customer-trust-evidence
npm run test:m162-regression
The local verifier reports failure with a non-zero exit code. Pack generation and verification are not exposed through MCP.
Coverage and measurements
Gaps stay visible.
Observed in the deterministic ten-case synthetic demonstration. No percentage is presented without its numerator and denominator, and no statistical significance is claimed.
18DEMONSTRATED
2PARTIALLY_DEMONSTRATED
3NOT_DEMONSTRATED
2OUT_OF_SCOPE
25TOTAL CONTROLS
Safety and trust boundaries
What the evidence does not establish.
No production deployment, payment execution, security certification, customer data, live employee directory or production key custody is claimed.
Local and synthetic
Synthetic/minimised data and opaque references only. No production secrets, live procurement, payment, settlement or customer communication.
Not production infrastructure
No production IAM or key custody, distributed durability guarantee, high availability or real external-effect reconciliation.
No outcome guarantee
No customer adoption or validation, regulatory approval, guaranteed compliance, guaranteed safety, proven ROI, fraud/loss reduction, statistical significance or business-outcome correctness.
Execution boundaryNo autonomous capital execution. No automatic retry after an uncertain execution state. The buyer retains control of any real execution boundary.
Controlled design-partner evaluation
One bounded workflow. Evidence first.
Paid evaluation pilots starting from £1,500. This is indicative, scope-dependent pricing—not a quotation, checkout or guarantee.
- One exact-action workflow with fixed scope.
- Local-first and synthetic or non-production unless separately agreed and safely designed.
- Buyer-defined mandate, policy and success criteria.
- Buyer-controlled execution boundaries.
- No guaranteed outcome, production approval or automatic access.
Human-reviewed enquiry
Bring a bounded authority problem, not production credentials or customer data.
The existing email route is the only pilot contact path. There is no form, payment collection, analytics or tracking.
Review pilot contact guidance →Reviewer routes
Trace every public claim to repository evidence.
Start with the README, reproduce M161, verify M162, then inspect architecture, threat-model and qualified standards-mapping material.
Mission 05 · optional source demo
Evaluate one exact supplier bank change.
Explore PayeeShield backed by ATG fixture evaluation and signed exact-action controls: changed requests, stale state, revocation, expiry, replay and same-process UNKNOWN reconciliation.
Source-only, local and synthetic; fictional data, public fixture keys and a fixed clock. Volatile process-local state. No live bank verification, payments, ERP writes or independent destination evidence. Separate from the unchanged local.7 plugin; GitHub Pages does not run the Node server.
PayeeShield evaluation and local setup →