Intent-Plane: Fail-Closed Authorization Gate for AI Agent Actions

Introduction

As AI agents increasingly take on roles involving irreversible actions, such as moving money or filing reports, the need for robust authorization and auditability becomes critical. Intent-Plane addresses this challenge by providing a fail-closed authorization gate. Before an agent executes any critical action, it must declare its intent. A deterministic gate then authorizes or refuses the action against a human-signed policy specification. Every decision is committed to a durable, append-only record, designed for independent re-computation and verification by external auditors.

Why Use It & Key Benefits

Intent-Plane offers a unique approach to securing AI agent operations, focusing on accountability and trust minimization:

• Fail-Closed Posture: The system is designed to refuse anything it cannot evaluate, ensuring that an action is never wrongly executed. Missing data, unsigned or revoked specifications, unreachable scorers, or empty criteria sets all result in a denial.
• Deterministic and Auditable Decisions: Every authorization decision is recorded in a durable feed, allowing auditors, compliance teams, or counterparties to re-derive every record from the feed alone, without trusting the gate's code.
• Exactly-Once Execution: Idempotency keys are derived from the action's canonicalized identity, preventing duplicate actions, regardless of how they are spelled or retried across instances.
• Governance Without Cooperation: Intent-Plane can front external services, imposing governance without requiring cooperation from the tool's owner. A refused call never reaches the backend.
• Two Sides, One Record: The repository provides distinct packages for the "audit side" (verifier) and the "platform side" (declarant), both converging on the same examinable record, ensuring independent verification.
• Robust Refusal Mechanisms: It explicitly refuses unevaluable intents, duplicates, calls it cannot key honestly, redirects, and any outcome outside its contractually closed vocabulary, providing strong guarantees against unintended actions.

Installation

Intent-Plane ships with Go packages, a Python twin with adapters, and an examiner's kit. Here's how to get started:

Go Packages (verifier/, declarant/)

go get github.com/hossainpazooki/intent-plane

These are public modules, Go 1.26, and stdlib-only, ensuring no transitive dependencies to review.

Python Twin + Adapters (declarant/pydeclarant/)

There is no PyPI package; you need to vendor the tree. Copy the declarant/pydeclarant/ directory into your project. The core modules (declare.py, client.py, gating.py) are stdlib-only. LangChain and MCP adapters are optional and require langchain-core and fastmcp respectively.

The Examiner's Kit (intent-verify + frozen fixtures)

This kit is built by you, not published as a release artifact:

scripts/release.sh

This script cross-compiles for various platforms and bundles byte-frozen good/tampered feed pairs with their expected reports. Integrity is ensured via SHA256SUMS and specific build flags for reproducible builds.

Examples

Here are examples demonstrating how to gate calls using the Python declarant SDK and how to verify a feed with the intent-verify CLI.

Gating a call, four ways (Python)

The gate sits at the tool-call seam, not in the prompt. Embed it once, and every agent inherits it:

from client import Client
from langchain_adapter import gate_tool                    # needs langchain-core
from mcp_adapter import IntentGateMiddleware, gated_proxy  # needs fastmcp
from reporting_adapter import ReportIdentity, gate_submission  # stdlib only

client = Client("http://127.0.0.1:8080")     # bounded, 30s per call, by default

# (a) a LangChain tool — one call
gated = gate_tool(my_tool, client,
                  intent_spec_hash=SPEC_HASH, scope="per-actor", run_id=run_id)

# (b) an MCP server you OWN — attach the middleware
server.add_middleware(IntentGateMiddleware(
    client, intent_spec_hash=SPEC_HASH, scope="per-actor", run_id=run_id))

# (c) an MCP server you do NOT own — front it, unchanged
gated = gated_proxy(backend, client,
                    intent_spec_hash=SPEC_HASH, scope="per-actor", run_id=run_id)

# (d) a regulatory-report submission — the plane never sees the report
done = gate_submission(ReportIdentity(reporting_entity=LEI, uti=uti, action_type="VALU",
                                      rule_set=RULES, as_of="2026-08-21"),
                       lambda: tr.submit(xml), client,
                       intent_spec_hash=SPECS, scope="per-actor", run_id=run_id)

Verifying a feed with intent-verify CLI

Take the audit side's seat and hand the CLI a feed to re-derive everything:

go run ./verifier/cmd/intent-verify core/contract/feed/events-good.jsonl      # RESULT: VERIFIED, exit 0
go run ./verifier/cmd/intent-verify core/contract/feed/events-tampered.jsonl  # one flipped byte: REFUTED, exit 1

Links

• GitHub Repository: https://github.com/hossainpazooki/intent-plane
• The Contract: CONTRACT.md
• Assurance Documentation: docs/assurance.md
• Integration Documentation: docs/integration.md
• Architecture Documentation: docs/architecture.md