01
Identity
Is this a registered agent with an accountable owner and a verifiable workload identity?
Authority stage · Catalyst Agent Gate
An agent can connect. That does not mean it may act.
Within Catalyst's accountability chain, Agent Gate is the authority checkpoint for AI actions. It checks who the agent is, what it wants to do, which evidence supports the request, and who may approve it. The result stays connected to delivery and outcome records.
Agent action requestIllustrative policy result
Requested operation
Write to a restricted data source
Held for named approval- Agent
- Registered support agent
- Operation
- External write
- Data class
- Restricted
- Authority
- No matching active lease
Business owner + Security + Privacy or Data owner
Policy holds this exact scope. No tool call is released by the evaluation.
A working demo of decision logic, not evidence of a live enforcement adapter.
The accountability chain
01Signal
02Evidence
04Action
05Outcome
01Preflight
Test the proposed agent and environment before deployment.
02Authorize
Name the approvers and issue bounded authority.
03Define
Record purpose, permissions, limits, supervision, and expiry.
04Enforce
Fail safely at the control point and return a receipt.
05Assure
Watch for drift, then revoke or reapprove when conditions change.
Continuous Behavior AssuranceTest before deployment. Watch the approved envelope at runtime. Respond when behavior changes.
PreflightEstablish the safe operating envelope
ObserveCompare real activity with approved conditions
RespondConstrain, reapprove, and verify recovery
01 · Preflight
Test the proposed agent before it reaches production.
Preflight evaluates identity, requested capability, data boundary, environment, policy, and required authority before deployment or an action-capable route. It uses control metadata, not the agent's prompts or responses.
02
Authority lease
Does the request fit an approved scope, expiry, call limit, cost ceiling, and delegation boundary?
03
Capability
Is this operation registered for the agent, environment, tool, and data class?
04
Policy
Do risk, data sensitivity, estimated cost, and lifecycle status permit this route?
05
Human decision
If authority is missing, which named owners must approve this exact request?
06
Receipt
What was requested, why was it held or denied, and which conditions governed the result?
02 · Authorize
Permission has an owner, a limit, and an end.
A lease can bind one agent to one capability, operation, environment, data class, budget, call count, delegation depth, and expiry. If identity assurance fails or scope is exceeded, the request is denied. Write actions and restricted data go to named approvers when authority is missing.
The source signal and reviewed evidence stay linked to the request. A held result can become a Pending Decision for the same scope. Approval produces a Catalyst Authority Grant. Delivery preserves a Decision Receipt, and the measured result becomes an Outcome Record. The gate evaluation never performs the action itself.
ScopeCapability, operation, environment, data
BudgetCalls and delegated cost ceiling
TimeExpiry and suspension conditions
ProofPolicy version, rationale, approval, receipt
03 · Define the operating envelope
Assure the operating envelope, not the agent itself.
A Catalyst-issued assurance record defines the purpose, permissions, limits, supervision, and expiry under which an agent may operate. It remains valid only while those conditions remain true. It is not an independent certification, warranty, or insurance policy.
Operating-envelope assuranceConditions satisfied
Assurance record AGA-MER-001
Registered support agent
- Approved purpose
- Draft responses from approved knowledge
- Authority
- Read and draft, never publish
- Prohibited
- Payments, identity changes, customer exports
- Validity
- Expires or suspends when a condition changes
Illustrative Catalyst-issued record from the working product concept. Assurance is scope-bound and conditional, not a permanent trust badge or external certification.
Conditional assurance
Record the exact purpose, data, tools, environments, actions, limits, and human supervision that define acceptable operation.
Continuous reassessment
Suspend and review the assurance record when the model, owner, tools, data access, behavior, policy, or enforcement path changes.
Evidence for underwriting
Package tested controls, revocation, incidents, authority receipts, and performance evidence for independent review by a licensed assurance or insurance partner.
Catalyst records operating conditions and control evidence. It does not warrant agent behavior or issue insurance. Any external certification or financial policy would require separate evaluation by the responsible licensed organization.
04 · Enforce at runtime
The control point must fail safely and leave proof.
A production pilot does not stop at a policy result. It must prove how identity is bound, where the decision is enforced, how revocation propagates, and which execution receipt returns to Catalyst.
Bind identity
Verify the agent and workload identity against the tenant and environment before policy is evaluated.
Pilot evidence: signed identity assertion and negative impersonation testFail closed
When identity, policy, evidence, or Catalyst availability is insufficient, no action-capable route is released.
Pilot evidence: timeout, outage, and stale-authority testsRevoke and expire
A lease ends on expiry, revocation, owner change, scope change, or a defined risk condition.
Pilot evidence: measured revocation propagation and blocked replayReturn a receipt
The enforcement point returns the decision identifier, effective conditions, operation, result, and timestamp.
Pilot evidence: receipt reconciled to the external system and audit record05 · Assure continuously
Approval is a starting point, not permanent trust.
Continuous Behavior Assurance compares observed control metadata with the agent's approved operating envelope. Catalyst does not need to collect prompts or responses to recognize a material change in authority, behavior, or outcome.
Purpose drift
Is the agent still performing the job that was approved?
Capability expansion
Is it attempting new actions, tools, or execution paths?
Data boundaries
Is it reaching a new data class, system, environment, or tenant?
Identity change
Did the agent, owner, workload identity, or credential change?
Delegation
Is it invoking agents or descendants outside the approved depth?
Memory movement
Is retained context moving beyond its approved purpose or boundary?
Operating pattern
Did calls, retries, latency, spend, or failure behavior materially change?
Outcome degradation
Did quality, security, service, or human-review results fall outside limits?
01Detect change
Record the changed condition and affected scope.
02Assess consequence
Separate expected variation from material drift.
03Constrain precisely
Hold only the unsafe capability or authority path.
04Reapprove
Route material changes to the named human authority.
05Verify recovery
Recheck the source and preserve the assurance record.
Catalyst recommends and records the response. Automatic operational containment requires an explicitly configured enforcement point and policy.
Portable by design
The agent stack can change. The authority record stays.
Catalyst uses a neutral request and decision model. Identity, runtime, enforcement, and evidence adapters bring context from the systems you already use.
Identity
Entra, Okta, CyberArk, another OIDC issuer, or an attested workload identity.
Agent runtime
Commercial, open-source, internally built, cloud, edge, and multi-model agents.
Enforcement point
A runtime hook, sidecar, proxy, API gateway, or connector pre-flight control.
Evidence
Audit streams, SIEM records, tickets, catalogs, billing exports, and source references.
Working demo
Deterministic policy evaluation, held requests, linked decisions, lease simulation, and readable reasons.
Production pilot
Identity verification, signed tenant-bound leases, durable audit, and a deployed enforcement adapter are configured and validated for your environment.
See a request held, challenged, and resolved.
Bring an agent action you would not want to approve blindly. We will show the decision path and what a production control point would need to enforce.
Book an Agent Gate demo