Standing Grants™ gives every AI seat — autonomous agent or employee — a work permit: bounded, expiring, metered, and audited before every action. Not a policy document — enforcement, in code.
Enterprises are deploying autonomous agents faster than they can govern them. The past year, measured:
Today's choices are both bad: approve every agent action by hand (unworkable at volume), or hand out open-ended standing permission (unaccountable). Every other high-stakes industry solved this decades ago — hot-work permits, spending limits, letters of credit, surety bonds. The instrument is a century old. It just didn't exist for AI actions.
Six guarantees. Each one is enforced in code and demonstrated by an adversarial test — not promised in a policy PDF.
| # | An agent under a Standing Grant cannot… | Verified |
|---|---|---|
| 1 | Exceed its budget — the N+1th action on an N-action grant is denied and logged | ✓ tested |
| 2 | Survive a code change — modifying governed code voids the grant at the next action | ✓ tested |
| 3 | Survive revocation — an operator revokes; the very next action is denied | ✓ tested |
| 4 | Roll over spent budget — a closed grant contributes nothing, ever again | ✓ tested |
| 5 | Authorize itself — no issuance path exists on the agent-facing surface, by construction | ✓ tested |
| 6 | Act unlogged — the audit record is written before the action; denials are logged before they return | ✓ tested |
Every grant also carries a named accountable human. Autonomous action always traces to a person.
This is a real capture: an agent holding a 3-action grant attempts a 4th action. It doesn't push through. It doesn't improvise. It stops and says so — with an audit ID.
consume 1: OK (1/3) consume 2: OK (2/3) consume 3: OK (3/3) consume 4: EXHAUSTED GRANT HALT grant_id: g_3ee560fda6c7 reason: EXHAUSTED audit_id: aud_8ba35d2f53d5 state: no further actions taken under this grant required: operator action (reissue, widen, or conclude)
The halt message is the product. When an agent's authorization runs out, the failure mode is a truthful, auditable stop — not a confident improvisation.
An operator mints a grant: who holds it, exactly which actions it covers, a budget, and an expiry — with a named human accountable for everything done under it. The agent's tools check the grant before every metered action; an audit record is written before anything executes; every action debits the budget; and when the budget is spent, the grant expires, or the operator revokes it, the agent halts honestly. Delivered over MCP, so any agent framework can adopt it without integration work.
Corporate cards have limits. Refineries issue hot-work permits. Banks issue letters of credit. Sureties void bonds on material change. Standing Grants is the same hundred-year-old instrument, built for AI actions.
A grant authorizes the act — it never certifies the content. What an agent produces under a valid grant still faces independent assessment. Permission is not proof, and this system never pretends otherwise.
Standing Grants is an authorization layer for cooperative-but-fallible agents and an audit trail for adversarial ones. It is not a sandbox. It does not authenticate identity, judge content, or stop a determined actor operating within its budget. We state what it doesn't do as precisely as what it does — that's the point of the whole system.
The reference implementation and hosted evaluation endpoint are available under a confidential evaluation agreement while the specification is finalized. Tell us what you're governing and we'll set you up.
Request access