Inquire +

Control plane

Beneath the model.
Above the infrastructure.

Guardrails live inside the model, so a swap or a jailbreak removes them. ALEETH does not. It is a control plane beneath execution: a single seam that consequential actions routed through ICA pass before they happen. In the Tool Gateway, deny is the default. Allow only what carries authority. Halt, quarantine, or gate anything that does not, in real time, while the act is still preventable.

One governed action

Four steps, and none of them optional.

This is what happens the instant an agent tries to move money, grant access, change production, send data out, or spawn another agent. It happens the same way every time, because the plane is beneath the agent, not beside it.

  1. 01

    Intercept

    The agent attempts a consequential action. It reaches the control plane before anything happens, at the seam every call must cross, not a log written after the fact.

  2. 02

    Resolve

    The plane resolves who is acting, under what authority and purpose, what the action is, its tool, its arguments, its data class, and on whom or what it acts.

  3. 03

    Decide

    In the Tool Gateway, deny is the default. Allow only what carries valid authority. Everything else is gated for a human, halted, or quarantined, while the action is still preventable.

  4. 04

    Seal

    The decision, allow or deny, is sealed to a signed, tamper-evident receipt before the action completes. There is no action without a record, and no record that can be rewritten.

The verdict

Four decisions. In the Tool Gateway, deny is the default.

Permission is the exception that has to be earned, one action at a time. Control is the resting state.

Allow

The action carries valid authority for this purpose, at this moment. It proceeds, and it leaves a receipt.

Gate

The action needs a human. It is held, routed to the right authority, and does not proceed until a person decides.

Halt

A live agent crossing the line is stopped mid-action. The halt is sealed before the stop completes.

Quarantine

A compromised or drifting agent is isolated. Its attempted steps are captured as forensic records, with no authority to act.

Containment

A contained agent has no path out.

The plane mediates the network the agent can reach. An agent reaching for the outside reaches a broker it cannot go around: the request either carries a valid, single-use capability or it does not leave. Containment here is a property of the architecture.

Authority at the moment of the act

Revoke today does not mean invalid yesterday.

Authority is not a snapshot of right now. A key rotated or revoked this morning must not retroactively void everything it validly signed last year, and no key may ever appear to authorize its own role. ALEETH resolves who was permitted to act against a signed, append-only history of authority, evaluated at the exact second the action occurred. When a regulator, an insurer, or a court asks whether the agent was allowed to do that, the answer is not a memo. It is math, reconstructed at the time of the act, and checkable from the signed record.

Next

The plane decides. The receipt proves it.

ICA receipts are Ed25519-signed and hash-chained, and can be checked offline with the published verifier against a saved copy of ICA's public keys. Anchored ledger roots carry a second signature from a key held in AWS KMS. The full seven-layer structure the plane enforces, the thresholds, and the named failure patterns live on the architecture page.

See the proof The seven layers, in full Verify a receipt yourself Authority MCP · 51 tools Gate a tool in a day