H33-API-G

The gate decides. The agent acts. They never merge.

An AI agent that holds its own credential is its own authority: it can decide what it is allowed to do, and nothing outside it can withdraw that. H33-API-G exists so that never happens. The authority to act lives in the gate; the work happens in the executor; and the executor cannot promote itself into the thing that authorized it. The chain runs one way — human intent → H33-Key → H33-API-G → Agent-008 execution admission → governed AI agent actions → evidence and proof package — and no link in it can reach back and re-authorize the link above.

An authorization_id is not an API key.

This is the whole product in one sentence: a static key is a secret that means “yes” to anyone holding it, while an authorization is a reference to a grant that can be examined, expired, and withdrawn. The first can only be rotated after the damage. The second stops the next call.

# one string. valid until a human remembers to rotate it.
API_KEY = "sk_live_…"

# the server can answer exactly one question:
#   is this string known?

authorization_id

# the gate can answer the questions that matter:
#   is this grant still live?
#   has this effect already been consumed?
#   what evidence did this call leave?

Request, invoke, evidence, verify, revoke, denied.

This is the sequence H33-API-G demonstrates in the pilot today. Every stage produces something an outside party can check — and the last stage is the one that distinguishes a governed authorization from a secret: after revocation, further use is refused.

Effects are single-use, and grants survive a restart.

Replaying a captured invocation is the oldest attack against a request-signing scheme. In the pilot, a replayed invocation is refused: the effect has already been consumed, and the gate says so by name rather than silently doing the work twice.

# the same invocation, submitted a second time

DENIED
ReplayState(AlreadyConsumed)

# the gate process restarts

# the grant is still there.
# authority is durable state, not
# something held in memory.

A governed capability, not a shell.

A grant is only meaningful if it names what it refuses. The pilot’s Agent-008 capability is deliberately narrow: the recipient gets authority to register AI agents, evaluate their decisions against governed policy, explain those decisions, and produce evidence — for a bounded window, and nothing else. The denial list is the product, not the fine print.

The service reports its own standing.

You do not have to take our word for what this is. The pilot endpoint publishes its environment, its admission status, and the digest of the binary that is actually running — so a reader can tell a pilot from a production authority without asking anyone.

{"status": "ok", "environment": "pilot"}

service
environment              pilot
admission_status         not-production-admitted
runtime_identity
runtime_id
artifact_digest          # SHA3-384 of the running binary
product_lane             # build commit
authority_reference

Walk the lifecycle end to end.

The walkthrough takes you through creating a trial identity, receiving a governed link instead of a key, authorizing Agent-008 for a narrow governance capability, evaluating an AI agent’s decision against governed policy, reading the evidence receipt, and then watching the same credential that worked all week stop working on its own. It is an illustrative client-side reproduction of the contract described on this page — it does not call the pilot endpoint.

H33-API-G governed access pilot. Not a production-admitted authority.