Where the agent's authority ends

Default deny, then exceptions

The policy gate denies by default. Actions that are irreversible or that expand spend surface a REQUIRE_APPROVAL verdict rather than executing. Domain registration is the clearest example: nothing about it can be quietly undone once the registrar has taken the order.

The agent receives the fact that approval is required and the place its human decides. It never receives a capability URL that can decide the gate.

The page carries the trust burden

The page where a human decides is the real trust surface. That person may have never seen this platform before and arrived from a link an AI handed them, so the page has to stand on its own. It must show:

• What the agent asked for, in plain language.
• Why — the agent's justification, verbatim and clearly marked as the agent's own words. It is untrusted content and is encoded on render.
• What it costs — one-time, monthly, or freed monthly — plus live budget headroom at the moment the page is viewed.
• What approving does and does not commit you to, including the undo or exit path, and an explicit irreversibility warning when there is none.
• What happens if you walk away: nothing runs, nothing is charged, the request expires by itself.

One decision, then it is closed

Single decision

First write wins. A gate cannot be re-decided by a second click or a replayed request.

Bounded wait

Gates auto-deny after a bounded timer — 48 hours is a reasonable default. No gate waits forever.

Reported as data

Expiry reaches the agent as a structured outcome, not a timeout, so it can tell you what happened.

Recorded

The decision, the decider, and the timestamp land in the ledger.

The agent cannot approve itself. Decision authority is the human principal's authenticated session. That is a property of the system, not a policy setting you could accidentally turn off.

Keep reading