Permissions
Who is allowed to do what?
Without explicit autonomy levels, every agent is a special case, and nobody knows where the line sits between what it decides alone and what requires a human.
AI agent governanceIn production
Your AI agents ask permission before acting
An autonomous agent that terminates a contract, modifies a system or commits your organization should never do so without guardrails. The portal gives every agent a clear frame: what it may do alone, what requires a human, and proof of every decision.
- Mandatory human verdict on critical decisions
- SHA-256 sealed traces
- Open protocol, Apache 2.0
Escalations
Awaiting verdictbilling-agent-01D3R3Expires in 23 h
Request: terminate supplier X's contract
The supplier has been missing the service agreement for 3 months.
ApproveDeny
The escalations inbox, inside the members' portal
The problem
Autonomy without governance is blind trust
AI agents take action: they write, buy, fix, deploy. Observability tools tell you what happened; nobody answers the question that matters: should it have happened?
Oversight
Who approves, and when?
Without an escalation path, sensitive requests get lost in a chat channel, or worse: the agent decides alone because nobody answered.
Proof
How do you demonstrate it?
When an auditor or regulator asks who authorized an agent's action, a screenshot is not enough. You need a tamper-evident chain of decisions.
The approval loop
Four beats, no blind spot
Every agent decision follows the same path, from the mundane to the critical.
01
Request
The agent asks for authorization
Before acting, the agent classifies its decision (type D1 to D4, risk R1 to R4, reversibility) and queries the authorization matrix.
02
Escalation
Critical items reach a human
Strategic decision, high risk or self-modification: an escalation is created and your team is notified in real time.
03
Verdict
A human decides
Approve or deny, with a mandatory comment on denial. First verdict rendered, first verdict kept. No answer within 24 h: denied.
04
Proof
Everything is sealed
Request, verdict and context enter a chain of traces linked by SHA-256 hashing, verifiable at any time.
Fail-safe by design: an agent that gets no answer does not act. Expiry means denial, never a free pass.
What the portal governs
Six mechanisms, one discipline
Everything you need to frame autonomous agents, from the first inventory to audit-ready proof.
Core of the system
Escalations with human verdict
Sensitive requests land in a dedicated portal inbox: full context, the agent's reasoning, Approve and Deny buttons. The decision always belongs to a person.
- Real-time notification
- Commented denial
- 24 h expiry
Agent registry
Every agent is declared with its autonomy level (A1 to A5), its allowed decision types and its maximum risk. Its access key can be revoked at any time.
- A1-A5 levels
- Revocable keys
Authorization matrix
Autonomy crossed with decision type yields an unambiguous verdict: authorized, approval required or prohibited. Self-modification always requires a human.
- D1-D4 × A1-A5
- R3-R4 risk overrides
Sealed trace chain
Every event is chained to the previous one by SHA-256 hashing. Tampering breaks the chain, and verification detects it immediately.
- SHA-256
- Built-in verification
Usage policies
Rules by category (external communications, financial commitments, data access) evaluated on every decision, with regulatory mapping.
- Law 25
- AI Act
- NIST AI RMF
Integration in minutes
Your agents talk to the portal through simple key-authenticated HTTP calls, or through the dedicated MCP server. No proprietary SDK required.
- HTTP + agent key
- MCP server
- LangGraph, CrewAI, n8n
Open protocol
Powered by ADP, the Agent Decision Protocol
Agent governance should not be a proprietary format. The portal implements ADP, an open protocol under the Apache 2.0 license: autonomy taxonomy, decision classification, trace format and authorization matrix are publicly documented.
- Public specifications: seven technical documents, JSON schemas included
- Apache 2.0 license: commercially usable, no lock-in
- Regulatory mapping: Law 25, EU AI Act, NIST AI RMF, ISO 42001
- The gouvernance.ai portal is its reference implementation
In preparation
A2A compatibility (Agent2Agent, Linux Foundation) in preparation: ADP governance will travel with agent-to-agent exchanges.
Not to be confused with the portal's MCP connector, which lets your AI assistants (Claude, ChatGPT…) drive your governance workspace. /connecteur-mcp
Frequently asked questions
What we get asked
Get started
Give your agents a frame before they need one
Create your account, declare your first agent and receive its first authorization request within minutes.
Free sign-up. Agent governance ships with the Member and Expert plans.