Platform
How BotAris governs what an agent may decide
One model of authority, enforced in every agent's action path, accounted for in one ledger.
Architecture overview
Agent layer
Control plane
BotAris Authority Governance Control Plane
Enterprise fabric
The control plane
Five components. One definition of authority.
Authority Model
Decision rights and constraints expressed as governed policy. The source every evaluation is checked against.
Decision Authority Enforcement Point (DÆP)
Patent pendingRuntime evaluation of each proposed action against delegated authority, in the agent's action path. Deployed where your agents already run.
Governed Authority Knowledge Base
Policies, decision taxonomies, authority templates, process constraints, escalation rules, and approved control narratives, versioned and human-approved.
Accountability Ledger
A tamper-evident record of decisions, delegations, and outcomes. Built to answer who authorized an automated decision and on what basis.
Governance Console
Oversight, management, and administration for the people accountable for agent authority.
Every DÆP pattern, from an in-process API call to a reverse proxy in front of an application, evaluates against the same Authority Model and writes to the same ledger. Patent pending
Every evaluated action resolves to one of four outcomes
Allow
The action is inside the agent's delegated authority. It proceeds, and the ledger records that it did.
Constrain
The action proceeds with limits applied, for example a reduced amount, a narrower scope, or added conditions. The ledger records the constraint and the reason.
Escalate to human
Patent pendingThe action needs a human decision. It is routed to the named escalation path with the context attached, and the human's answer is recorded.
Deny
The action is outside authority. It does not proceed, and the ledger records the reason.
Which of the four applies is decided when the action is proposed, not when the agent was provisioned. That is the line between runtime authorization and the permissions an agent already holds: permissions describe what it can reach, the outcome describes what it was allowed to decide this time. Granting the narrowest authority that still completes the task is least privilege for agents, expressed in decisions rather than access.
Enforcement
Six ways to put the enforcement point in the action path
Patent pendingDecision Authority API
The agent or its framework calls BotAris before a consequential action. In-process, for agents you build.
AgentGate Enforcement
BotAris's own inline gateway for agent traffic. It terminates the agent's outbound connection, resolves the caller to its governed authority, evaluates the requested action against decision rights, constraint ceilings, and the delegation chain, then forwards, transforms, or rejects it. Enforcement is synchronous and in the path. Protocol-aware for MCP and common tool-calling patterns, so it evaluates the action, not just the destination.
API Gateway or Reverse Proxy
A required check at the API tier, or a proxy in front of an application that cannot be integrated. Governs by protected surface, whatever is calling.
Sidecar or Service Mesh Enforcement
Beside the agent in its pod or mesh, so the agent has no path to enterprise systems except through BotAris.
Tool Broker or MCP Gateway
Every tool call an agent makes passes through a broker that evaluates it first.
Event-Only Decision Ledger Mode
Observe and record every decision without enforcing. The starting point for a surface you have not governed before.