The Gate
Nothing irreversible should go through alone.
The Gate sits between a machine and the systems it acts on. Reads are meant to go straight through. Refunds, deletes, deploys and mass messages that break your rules wait for the person you named or are blocked, and every decision leaves a signed receipt.
Where it sits
One checkpoint on the path every action already takes.
A machine can only act through the keys and tools it is given. The Gate sits on that path, so it sees the action before the world does.
Your machine
Your systems
The Gate
read last week's orders
Runsrule read_only v3
refund a customer $4,800
Waits for a personrule money_out v3
delete the production database
Blockedrule data_destroy v3
Example rules running in your browser. Nothing you type leaves this page.
Where it can sit
Four places, from a lock to a seatbelt.
Tier A
Key broker
The machine holds a scoped token, never the real key. No key, no action. Meant to be the hardest to get around.
Tier B
Tool gateway
Between the agent and its MCP tool servers. Holds risky tool calls and pins what each tool is allowed to be.
Tier C
In-process hooks
Inside the agent's own code. Quick to add, but a seatbelt, not a lock: the process could route around it.
Tier D
Pipeline gates
Deploy gates and restricted provider keys. Meant to lock one path as firmly as Tier A.
Each receipt is designed to carry its tier, because a lock and a seatbelt are not the same evidence.
What it holds
Eight kinds of action that are hard to take back.
Every action is sorted into a class before anything else happens. Each class carries how bad it can get (an amount, rows, recipients) and how long you have to undo it, if at all.
MONEY.OUTRefunds, payouts, transfers and charges.
refund $4,800DATA.DESTROYDeleting a database, a bucket or a volume. A DELETE with no WHERE.
drop table ordersINFRA.DESTROYTearing down servers, clusters and networks.
terminate the clusterDEPLOY.PRODPromoting or rolling back what runs in production.
deploy 2.4 to prodACCESS.GRANTKeys, roles and visibility handed to someone new.
make the repo publicCOMMS.MASSAnything sent to many people at once, or posted in public.
email 40,000 customersCODE.HISTORYForce pushes and rewritten history.
git push -f origin mainLEGAL.COMMITAccepting terms, signing, filing a form.
accept the termsHow it decides
Rules you can read. The same answer every time.
A rule a claim may one day rest on can't be a guess. So the Gate decides with plain rules you write and version, not with a model's mood.
- Three answersIt runs, it waits for a person, or it is blocked outright.
- VersionedThe rule and its version go into the receipt, so the decision can be checked the same way a year later.
- Fails closedIf the Gate can't read an action, it is designed to hold it. With the key broker, a Gate that is down means no key, so no action.
- A model may only add a holdA risk score can make the Gate more careful. It can never wave an action through.
rule money.out v3 class MONEY.OUT when amount >= 1,000 USD then hold for billing lead else run, record unread hold sign receipt, every time
Try it
Describe an action. Watch the gate decide.
Example rules running in your browser. Nothing you type leaves this page.
Send an action.
The gate reads the action, matches a rule, and decides: it runs, it waits for a person, or it is blocked.
- receipt
- none yet
- sha-256
- none yet
- ed25519
- none yet
Example rules in your browser, signed with a throwaway key. Your own rules decide in the real Gate, which is being built.