Authority for AI-Agent Actions
Across External Systems
DETERMA binds a proposed action to its evidence, exact target, current state, approval context, execution scope, and verified outcome before the action may proceed.
The currently validated mutation slice remains governed Git mutation in an isolated sandbox. External Action Control is an architecture-incubator extension for bounded simulation, shadow-mode design, and future sandbox validation. No production enforcement, no vendor integration, and no customer traction are claimed here.
Scope of this page
Extension, not replacement
The DETERMA homepage continues to lead with AI Software Change Control. This page describes a market-general extension of the same authority primitives.
Design-partner evaluation
Everything below is available for bounded, controlled evaluation. Nothing here implies production readiness for any external system.
Truthful boundaries
No named vendor partnership, integration certification, live production mutation, or customer evidence is implied by this page.
Generic governed-action flow
Nine stages between an agent’s idea
and a verified external action.
Each stage is a distinct authority checkpoint. Any stage may deny or halt. No stage may be skipped in a governed run.
Agent Proposal
AI agent or workflow drafts a proposed action with references to the context that produced it.
Evidence Binding
The proposal is bound to source evidence fingerprints so the action cannot be separated from the reasoning behind it.
Action Envelope
The proposal is normalized into a canonical envelope: target system, object, field, before-state, proposed after-state, and constraints.
Approval Context
Approval identity, scope, and freshness are captured so authority is exact-action-bound and not a general grant.
Target-State Witness
Current state of the target record is re-read at decision time. Drift from the approved before-state fails closed.
Single-Use Release
A one-time execution release is issued for exactly this envelope, scoped by idempotency key and expiry.
Constrained Executor
A narrow domain adapter applies only the allowed field or operation. No adapter is permitted broader authority than its envelope.
Post-Action Verification
The target system is re-read after execution to confirm the observed outcome matches the approved after-state.
Evidence Receipt
A signed, cross-system receipt records the decision, envelope, witness, release, and verification for audit.
Interactive simulator
Governed action, made visible.
Choose a workflow domain, review the bounded action envelope, then simulate an authority verdict. All examples are conceptual. No external system is contacted.
Action Envelope
RISK LOWUpdate one CRM opportunity field
- source_agent_ref
- revops.assist.agent
- evidence_fingerprint
- sha256:call-2026-07-11-note-42a…
- target_system
- crm.system (example)
- target_object
- Opportunity
- target_resource
- opp_00A123
- allowed_field_or_op
- next_step
- observed_before_state
- next_step="Awaiting proposal"
- proposed_after_state
- next_step="Legal review scheduled 2026-07-20"
- idempotency_key
- idem_act_1f9353b0
- expiry
- +15m from issuance (example)
- risk_class
- LOW
Human boundary: Human RevOps approver remains final authority for pipeline mutations.
Deterministic Receipt
The simulator is deterministic. It does not connect to any external system, execute any action, or represent any customer or vendor data.
Workflow classes evaluated
Applicable to many workflows.
Bound tightly in every one.
Named platforms elsewhere on this page are examples of workflow context, not validated integrations. Nothing here implies a vendor partnership, certification, or supported connector.
Revenue and CRM operations
Bounded example: Update a single opportunity field bound to specific call evidence.
Human / authority boundary: Human RevOps approver retains authority over pipeline-shape decisions.
IT service management
Bounded example: Advance one incident status with a bound runbook step.
Human / authority boundary: Change window and rollback authority remain with on-call engineers.
Cloud & infrastructure operations
Bounded example: Adjust one allowlisted parameter in a sandbox environment.
Human / authority boundary: Production accounts, IAM, network, and secrets remain out of scope.
Finance operations
Bounded example: Prepare a draft payment instruction for human release.
Human / authority boundary: Payment execution and treasury movements are strictly out of scope.
Healthcare administration
Bounded example: Update a non-clinical scheduling field.
Human / authority boundary: No clinical decision-making, diagnosis, or treatment authority.
Procurement & enterprise operations
Bounded example: Move a purchase request between defined approval stages.
Human / authority boundary: Contract award and financial commitment remain with the category manager.
Control primitives
Reusable authority primitives.
Canonical Action Envelope
Normalized description of the exact proposed action, target, and constraints.
Evidence Binding
The action is inseparable from the evidence that produced it.
Exact-Action Approval
Approvals authorize a specific envelope — not a general grant to an agent.
Target-State Witness
Current state is re-read at decision time; drift fails closed.
Risk-Based Approval Matrix
Envelope risk class routes the required approver, evidence, and freshness.
Single-Use Execution Release
One-time release scoped to the envelope, idempotency key, and expiry.
Constrained Domain Adapter
Adapter authority is narrow by construction; scope is enforced, not documented.
Post-Action Verification
Target is re-read after execution to confirm the approved outcome.
Cross-System Evidence Receipt
Signed, append-only receipt linking decision, envelope, witness, release, and verification.
Unknown-Outcome Halt
If verification is inconclusive, the system halts. No blind retry.
Readiness ladder
Truthful about what exists today.
- AVAILABLEArchitecture defined.
- AVAILABLEDeterministic simulator (this page).
- DESIGN AVAILABLEHistorical action replay design.
- DESIGN AVAILABLEShadow-mode design (non-blocking).
- NOT YET VALIDATEDVendor-specific read-only connectors.
- NOT YET VALIDATEDSandbox mutation adapters, except the existing Git-sandbox slice.
- NOT AVAILABLEInline production enforcement for external systems.
Design-partner path
Earned expansion, not blanket rollout.
- STAGE 01
Historical Action Replay
Metadata-only reconstruction of agent-initiated actions and their approval context. No code execution, no writes.
- STAGE 02
Live Shadow Mode
Non-blocking observation of agent actions. Deterministic verdicts recorded but never enforced.
- STAGE 03
Advisory Control
Verdicts surfaced to humans in-workflow. Humans remain the final authority for every action.
- STAGE 04
Sandbox Action Control
One object, one field or operation, one constrained adapter — validated in an isolated environment.
- STAGE 05
Bounded Enforcement
Only after explicit customer validation and governance approval of the specific bounded surface.
Truth boundary & legal clarity
Clear about what this is — and isn’t.
- No named vendor partnership or certification is implied by this page.
- No production mutation of any external system is claimed.
- No broad agent-governance replacement claim is made.
- No clinical decision-making, payment execution, or unrestricted cloud mutation is offered.
- Named platforms are used only as examples of workflow context, not as validated integrations.
- Bounded, metadata-first evaluation and deterministic simulation are the available surfaces today.
Return to primary product
Primary product: AI Software Change Control
DETERMA today leads with AI Software Change Control. External Action Control is a market-general extension of the same authority primitives, offered here as an architecture incubator for bounded evaluation.