The agent trust layer is where an action is authorized before it happens and proven after.
An AI agent governance platform is not a filter on prompts and not a log you read later. It is a control plane that sits between an agent's decision and its effect: it checks who the agent is, whether the action is in scope, whether policy allows it, and whether a human must approve — then it emits a signed receipt that proves what occurred. ApexClaw is built from five such surfaces, each a control before an action or an evidence object after it.
Get an Agent Trust Gap BriefFive surfaces, one trust spine
Each surface answers one of the questions a board, auditor, or regulator will ask. Each links to its own detailed page with the controls, the standards it maps to, and the evidence it produces.
Agent identity & the Agent Passport
Every agent carries a passport: a cryptographic identity, a human accountable owner, a mission, a permission set, an autonomy level, and a lifecycle state. Machine identities already outnumber human ones by more than 80 to 1 in most enterprises, and an agent without an identity is an action you cannot attribute. This surface covers non-human identity, least privilege, credential rotation, ownership mapping, and discovery of the agents you did not know you were running.
Covers: agent identity management · non-human identity · Agent Passport · least privilege · workload identity · agent discovery & sprawl · joiner-mover-leaver · ownership mapping
Agent identity →Policy enforcement & the Assurance Gateway
A deny-by-default gate stands between decision and execution. It evaluates scope, tool permissions, autonomy budget, suppression lists and rate limits, and where an action is consequential it requires a payload-bound, single-use, expiring approval — so approving one action never silently approves the next. This is the difference between a guardrail that filters and a gate that authorizes.
Covers: policy-as-code · deny-by-default · payload-bound approval · human-in-the-loop · autonomy levels L0–L4 · separation of duties · circuit breaker · kill switch
Policy enforcement →Execution receipts & the Flight Recorder
Every consequential action emits a signed, hash-chained receipt: the identity, the policy version, the approval, the payload hash, the provider response, the outcome. Because the receipts are chained, tampering with one breaks verification and the evidence shows exactly where. An audit log can be edited; a signed receipt chain cannot be edited unnoticed. The full history is replayable for any incident review.
Covers: signed execution receipts · hash-chained & append-only · tamper-evident logs · replay & reconstruction · provenance · evidence packs · audit-log vs receipt
Execution receipts →MCP governance
The Model Context Protocol is how agents reach tools, and the 2026-07-28 specification hardened its authorization model onto OAuth 2.1 with an Enterprise-Managed Authorization extension — while giving legacy versions a twelve-month deprecation window that most teams have not yet planned for. This surface governs MCP server identity, per-tool authorization, tool-exposure assessment, and the confused-deputy and token-passthrough failure modes the new spec exists to close.
Covers: MCP 2026-07-28 · Enterprise-Managed Authorization · OAuth 2.1 resource server · tool-exposure assessment · tool poisoning · server inventory · OWASP MCP Top 10
MCP governance →Agent wallet & payment governance
Agents are beginning to move money. AP2, now under the FIDO Alliance, proves a human authorized a specific spend with cryptographic mandates; x402 settles agent payments over HTTP with no human in the loop at all. Either way, the governance question is the same: a hard, fail-closed ceiling on actions, rate and spend that refuses at the limit and emits a receipt — a cap, not a throttle. This surface covers spend budgets, merchant allowlists, payment kill switches, and the evidence a dispute or a CFO will demand.
Covers: agent wallet governance · AP2 · x402 · autonomy budget · spend caps · payment receipts · fail-closed refusal · CFO & treasury controls
Wallet governance →The minimum trust spine
Before any of the above is a product feature, it is a checklist. An agent that touches revenue, procurement, or sensitive data needs, at minimum, every link in this chain — because the chain is only as strong as the step you skipped.
- Evidence gathered and attributed to a source
- A canonical decision — one authority, never two
- A deterministic policy check
- Human approval where the action is consequential
- A single canonical effect owner executes it
- A circuit breaker that can fail closed
- An idempotency key so nothing fires twice
- A provider adapter with a bounded response
- A recorded response
- A signed receipt
- A verified outcome
See where your agents stand
The Agent Trust Gap Brief is a fast, low-friction read of your publicly and structurally observable agent risk surface — the inventory, the top trust gaps, the missing controls, and the one next step — with clear limitations stated. It is the front door to the platform.
Get an Agent Trust Gap BriefMore platform capabilities
Stopping an agent, and seeing what it actually did.
Revocation & kill switch
How authority is withdrawn, how fast it propagates, and how you prove the agent stopped.
Read →Agent observability
Why traces are not governance evidence, and the signal almost nobody captures.
Read →ApexClaw Receipts
The receipt format used inside our governance audit — eight objects, seven invariants. Not a standalone protocol.
Read →Why a trust spine, and what it maps to
Machine identities already outnumber human ones by more than 80x in most enterprises, and Gartner projects that more than 40% of agentic AI projects will be cancelled by the end of 2027 — the gap this platform exists to close. Enforcement failures are not abstract: the EU AI Act's three penalty tiers run up to 7%, 3% and 1% of global turnover depending on the obligation breached.
- Machine-identity ratio: more than 80x human identities in most enterprises (agent identity surface).
- Agentic AI project cancellation rate: more than 40% by end of 2027 — Gartner.
- EU AI Act Art.99 penalty tiers: up to 7% / 3% / 1% of global annual turnover — see the cost-of-audit-failure breakdown.
Standards and specifications referenced on this page: MCP 2026-07-28 authorization changes, OWASP Top 10 for Agentic Applications, NIST AI RMF, ISO 42001, and the EU AI Act.
- Standards this platform maps to: OWASP Top 10 for Agentic Applications.
- Risk-management framework: NIST AI RMF.
- Management-system standard: ISO/IEC 42001.
Common questions
What is an agent trust layer?
The control point between an AI agent's intent and its effect on the world. It evaluates policy before an action, requires approval where the action is irreversible, and produces signed evidence of what happened.
Does it replace our AI platform?
No. It sits between the agent and the systems it acts on. The agent, the models and the orchestration stay where they are.
What if the agent bypasses it?
Then it is not a control. Enforcement has to live in the component that holds the credential and performs the effect, not in the agent's instructions.
What is the minimum useful deployment?
Governing one irreversible action class — usually sending or paying — end to end, with approval and receipts. That proves the model and produces evidence immediately.
How does this relate to model safety?
It is downstream of it. Model safety concerns what the model produces; this concerns what is permitted to happen as a result.
An agent without an identity is an action you cannot attribute. Every other control depends on fixing that first.