Why · the gap in the stack
Adjacent systems answer permitted. We answer intended.
Policy engines answer whether an action is permitted. Guardrails answer whether the output looks safe. Observability answers what happened. None of them answer whether the action matched what was intended in this context, before it ran. That is the gap — and once agents act autonomously, it is the only gap that matters.
01 · What changed
The actor used to be a person. Now it isn’t.
Every control in your stack was designed around a human in the loop. RBAC assumes a person clicked. Code review assumes a person read it. The change-management ticket assumes a person filled it out. Those assumptions were load-bearing — and an autonomous agent breaks all of them at once. It can open a thousand pull requests, issue a thousand refunds, or rotate a thousand keys in the time it takes a human to read one alert.
The industry’s answer so far has been to watch harder — more guardrails, more eval suites, more dashboards. But watching is after the fact. By the time an anomaly surfaces on a dashboard, the git push already happened, the payment already cleared, the robot already moved. You cannot observe your way to safety once the actor moves faster than the observer.
02 · Where the gap lives
Four good systems, each answering a different question.
None of these are wrong. Each is necessary. But each answers a question one step away from the one that gates an autonomous action — and the gap between them is exactly where an agent does damage.
“Is this permitted?”
IAM, RBAC, OPA. They evaluate a role against a rule. But an agent with valid credentials is permitted to do almost anything — permission is not intention. The token says can, not should.
“Does the output look safe?”
Content filters and output classifiers score the text the model produced. They never see the action it triggers downstream, and a perfectly polite sentence can still authorize a destructive operation.
“What happened?”
Tracing and logging reconstruct events after they occur. Essential for forensics, useless as a gate. A log entry is a record of an action that already executed.
“Was this intended, here, now?”
Intended interprets the action, anchors it to a canonical intent, scores conformance against your declared process, and decides — before execution. The one question the others skip.
03 · The contract
The four principles.
Nothing autonomous moves without consent.
Every consent is cryptographic.
Every consent is auditable.
Every audit is provable without us.
These are not aspirations — they are the runtime invariant. Consent is an Ed25519-signed Authority Token minted only when policy, risk, and conformance all permit. Auditable means every decision is sealed and hash-linked. Provable without us means the connector verifies the token against a public key, so the guarantee survives even if Intended is offline.
04 · You can’t govern what you can’t name
Intention has to be named before it can be decided.
Every agent framework invents its own vocabulary for actions, so policy never lines up across vendors. Open Intent is the shared language underneath the contract: 173 canonical intents across 29 domains, versioned and Apache 2.0. A coding agent’s deploy, an RPA bot’s deploy, and a robot arm’s grasp all resolve to a stable code an authority decision can read — and an auditor can too.
05 · What follows
If verification fails, nothing ran.
The contract is enforceable because the connector verifies the token, not Intended. If the token is missing, malformed, expired, or reused, the gate refuses — in the target system, fail-closed. There is no silent allow path, no default-open fallback, no undocumented bypass. The whole guarantee reduces to one line: no token, no action.