Defined at Design Time. Enforced at Runtime.
Before an agent acts, "what may it do?" needs an answer the platform enforces, not a policy memo. Who is acting, what it may touch, which decisions stay human, which models may run. Most tools watch agents and report afterward. Ariad checks before a system of record is touched.
- bound_to:
- client-issue-resolution
- default:
- deny
- allow:
- case_system.read, crm.read
- deny:
- crm.write, ledger.*
- block:
- PII.ssn, PII.dob, card.pan
- gates:
- credit > threshold → owner
- models:
- registry.approved · pinned
- enforced:
- at runtime, every action
What Is This Agent Allowed to Do, and What Stops It?
Every agent acts as itself, never on a shared credential or a person's login. Identity comes from your identity provider; nothing has access until you grant it.
Default-deny contracts, bound to the outcome, enforced before execution. Drift between stored and enforced is surfaced, never tolerated.
Gates designed with your risk partners and made safe to wait for. The run holds; nothing downstream runs; the wait is on the record.
Any attempted action resolves one of three ways. Never a fourth.
Allowed: it ran, signed, into the pack. Blocked: it never reached the system, and the attempt is visible. Gated: it waits safely for a named person. The check happens before execution, not in a report the next morning.
- Scopes set what an agent can ever touch; the contract bounds behavior on top of them
- Both act before execution
Default deny. Bounded to the outcome. Written in terms the platform can check.
A contract sets the sources, tools and data an agent may use, with PII blocked, and is enforced on every call, including on a console. Explicit deny beats explicit allow beats the default, which is deny. The only ways out are a new validated version or a one-time expiring exception, both on the record.
- Contracts are validated at build time against the spec; an agent not on the approved version is flagged
- Versioned like code, pinned to in-flight work: a change made Tuesday cannot rewrite work that started Monday
Every agent acts as itself. Ariad creates no identities of its own.
Ariad federates to your identity provider; nothing has access until you grant it. Most enterprises give each agent its own service account. Where policy does not allow that yet, scoped tokens per integration keep the same boundary and people execute the steps that touch systems of record.
- Effective reach is the intersection of identity, tool grants and contract
- Never a shared credential, a borrowed session or a person's login
The fastest test of whether a control plane exists at all.
Ask any vendor: when an agent is blocked, where do you see it? If the answer is "it hasn't come up," nothing is being enforced. Ariad records every blocked action: the agent, the attempt, the rule that stopped it, the signature. Under Complete, the Governance Desk handles each one.
- Blocked before the system was touched, not flagged after
- Visible to the outcome owner and in the evidence pack
The decisions that stay human, made safe to wait for.
Where the consequence is high, the plan puts a gate: a named owner gets the recommendation, the evidence and the trace in one packet. The run holds until they decide. Business decisions are always your people's. Operational gates, under Complete, are the desks' with authority you delegated.
- Thresholds, regulatory exposure and the final client response are marked before anything runs
- Approve, delegate, request more evidence, or send back
routed to Maria R., outcome owner · recommendation, evidence and trace attachedheld 46 min
nothing ran meanwhile
Nothing runs that was not reviewed in.
Nothing deploys until the contract is validated, permissions are scoped, gates are owned and the version is pinned. Plan changes arrive as diffs for approval. Agent configuration is reviewed in place, with the model chosen from your approved set.
- Intake is a checklist the platform enforces, not a meeting
- Model gateway and registry: your keys, your approved models, assigned per agent by risk and cost; gateway coverage is emerging and we mark it that way
Change control at a major credit card issuer, run to a definition of done with the approvals built in.
Every change under contract, every approval a named gate, every step signed. The cycle moved because the controls moved with the work.
In Your Words.
Can an agent widen its own access?
No. Reach is identity, tool grants and contract together, enforced before execution. Changing any of them is a change a person approves.
What happens while a gate is waiting?
The run holds and nothing downstream executes. The owner can approve, delegate, ask for more evidence or send it back. A three-day approval costs three days, not a rerun.
How do we know which agent did what?
Each agent has its own identity from your identity provider. Every action in the pack is attributed to that identity or to a named person.
Our policy does not allow service accounts for agents. Does this still work?
Yes. Scoped tokens per integration keep the same boundary, and your people execute the steps that touch systems of record.
Will the same case be handled the same way next time?
Model settings are declared and pinned, contracts and gates are enforced the same way every run, and the evidence shows exactly what happened. Your reviewers verify it run by run.