Agent Integration Gateway
Protocol-compatible MCP stdio operation using version 2025-06-18. Only atg.evaluate_action is exposed. There are no MCP execution, policy-administration, revocation or emergency-control tools.
Local synthetic prototype · evidence controlled
Exact Action Trust Gateway for AI agents.
Agent Trust Gate™ checks whether an AI agent’s exact proposed action remains within a human-authorised mandate at the point where action authority would be granted. It returns deterministic evidence and, only where permitted, a tightly bound one-use GatePass.
ATG does not decide whether an action is commercially wise, beneficial or correct. It verifies declared authority, exact-action integrity, policy conditions and lifecycle state.
Review verified evidence →Install the local plugin →Try the ATG Challenge →Open repositoryDiscuss a controlled pilot
Local-onlySynthetic evidenceNo live executionNot production ready
Agent Integration GatewayLocal MCP over stdio; exactly one evaluation tool.
Exact Action Trust GatewayCanonical action, mandate and one-use GatePass controls.
Business AssurancePolicy, Shadow Mode, exposure, stop and recovery evidence.
Customer Trust EvidenceNon-authorising receipts, Coverage Map and reproducible metrics.
Standalone plugin · local evaluation edition
Bring ATG into your existing agent project.
Install one Node.js package to evaluate exact actions through an SDK or local MCP. It reuses the ATG authority core and includes a gated synthetic execution example. The purchase-order approval carries signed business state, checked again at synthetic commit and during reconciliation. Changed state requires fresh approval; uncertainty holds further work.
local.4 also includes optional Node 24+ shared-worker evaluation: separate processes, local SQLite, one machine. Legacy SDK/CLI/MCP remain Node 20 compatible. Start with one bounded workflow and inspect the decision evidence. Shadow observation grants no authority. A live integration requires a host-owned execution adapter and separately engineered trust infrastructure.
Version 0.1.0-local.4
Easy to install. Explicit about scope.
Local synthetic authority and evidence, fixture keys and a fixed reference clock. No live purchasing or payment, production-readiness claim, self-learning or automatic authority expansion.
The point-of-action gap
Legitimate instructions can still become a changed action.
An agent may start with a valid task and later propose a different supplier, quantity, price, account, destination, resource or timing. Model confidence does not create authority.
The ATG question
Does the evidence authorise this agent to perform this exact action, here and now, within these limits?
Verify authority before AI acts. No verified standing. No current authority. No exact-action proof. No valid GatePass. No action.
One coherent architecture
Integrate, decide, assure.
The three layers share the same exact-action authority core. The integration boundary does not create authority; the trust gate does not execute; assurance artefacts do not become permission.
Exact Action Trust Gateway
Checks registered tool/schema identity, agent standing, human mandate, policy, freshness and lifecycle state. GatePass remains exact-action-bound, expiring, revocable and one-use.
Business Assurance & Customer Trust
Adds buyer policy contracts, deterministic risk tiers, Shadow Mode, aggregate exposure, emergency stop, recovery, Customer Trust Receipts and an evidence-backed Coverage Map.
How ATG works
Deterministic controls before permission.
All current public scenarios are local and synthetic. One frozen in-process synthetic adapter can acknowledge one permitted demonstration action; it makes no real order or payment.
01
Mandate
A human defines bounded authority and evidence requirements.
02
Propose
The agent submits one exact canonical action.
03
Evaluate
Standing, mandate, policy, evidence and lifecycle checks run.
04
Verdict
ACCEPT, REJECT, REFER, or revocation prevents progression.
05
Evidence
Decision and any synthetic execution receipt remain separate.
ACCEPTAll mandatory checks pass; enforced mode may issue a one-use GatePass.
REJECTThe action is invalid, prohibited, altered, unauthorised or unverifiable.
REFERNo authority is granted; human review or additional evidence is required.
REVOKEInternal lifecycle control invalidates unconsumed authority; it does not reverse execution.
Shadow Mode: runs the same proposed-verdict path but issues no GatePass, mutates no enforcement state and grants no execution authority.
P3-M161 verified demonstration
Ten purchasing lifecycle cases.
Observed in the deterministic ten-case synthetic demonstration. The outcomes below are fixed local evidence, not customer, production or statistical results.
| # | Case | Verdict | GatePass | Execution evidence |
|---|---|---|---|---|
| 1 | Exact authorised purchase | ACCEPT | Issued and consumed | Synthetic acknowledgement |
| 2 | Quantity substitution | REJECT | None | None |
| 3 | Supplier substitution | REJECT | None | None |
| 4 | Price-band breach | REFER | None | Human review required |
| 5 | GatePass reuse | REJECT | Already consumed | Blocked |
| 6 | GatePass revocation | REJECT | Revoked | Blocked |
| 7 | Shadow Mode | would ACCEPT | None | None |
| 8 | Aggregate ceiling | REFER | None for breaching action | None |
| 9 | Authority expansion | REJECT | None | None |
| 10 | Emergency/recovery | REJECT | Progression blocked | No automatic retry |
P3-M162 Customer Trust Evidence
Verify evidence without turning it into authority.
Customer Trust Receipts are digest-bound summaries derived from verified local evidence. They are non-authorising and cannot reserve, execute, retry, revoke or act as GatePasses. Decision and execution receipts remain separate.
- Tampered, missing, substituted or mismatched evidence fails verification.
- The verifier checks canonical bundle content and locked source evidence.
- Reviewer-readable Markdown and machine-readable JSON derive from the same evidence.
- Evidence says what was demonstrated and keeps absences visible.
npm run evidence:m162 -- --output-dir examples/p3-m162
npm run verify:m162 -- --input examples/p3-m162/evidence-bundle.json
npm run test:customer-trust-evidence
npm run test:m162-regression
npm run verify:m162 -- --input examples/p3-m162/evidence-bundle.json
npm run test:customer-trust-evidence
npm run test:m162-regression
The local verifier reports failure with a non-zero exit code. Pack generation and verification are not exposed through MCP.
Coverage and measurements
Gaps stay visible.
Observed in the deterministic ten-case synthetic demonstration. No percentage is presented without its numerator and denominator, and no statistical significance is claimed.
18DEMONSTRATED
2PARTIALLY_DEMONSTRATED
3NOT_DEMONSTRATED
2OUT_OF_SCOPE
25TOTAL CONTROLS
Safety and trust boundaries
What the evidence does not establish.
No production deployment, payment execution, security certification, customer data, live employee directory or production key custody is claimed.
Local and synthetic
Synthetic/minimised data and opaque references only. No production secrets, live procurement, payment, settlement or customer communication.
Not production infrastructure
No production IAM or key custody, distributed durability guarantee, high availability or real external-effect reconciliation.
No outcome guarantee
No customer adoption or validation, regulatory approval, guaranteed compliance, guaranteed safety, proven ROI, fraud/loss reduction, statistical significance or business-outcome correctness.
Execution boundaryNo autonomous capital execution. No automatic retry after an uncertain execution state. The buyer retains control of any real execution boundary.
Controlled design-partner evaluation
One bounded workflow. Evidence first.
Paid evaluation pilots starting from £1,500. This is indicative, scope-dependent pricing—not a quotation, checkout or guarantee.
- One exact-action workflow with fixed scope.
- Local-first and synthetic or non-production unless separately agreed and safely designed.
- Buyer-defined mandate, policy and success criteria.
- Buyer-controlled execution boundaries.
- No guaranteed outcome, production approval or automatic access.
Human-reviewed enquiry
Bring a bounded authority problem, not production credentials or customer data.
The existing email route is the only pilot contact path. There is no form, payment collection, analytics or tracking.
Review pilot contact guidance →Reviewer routes
Trace every public claim to repository evidence.
Start with the README, reproduce M161, verify M162, then inspect architecture, threat-model and qualified standards-mapping material.