Doctrine
AI proposes. Humans determine. Cryptography proves.
Autonomous actors are already inside the systems that matter. They hold credentials to repositories, databases and money, and almost none of that reach was deliberately granted by a named human. Interlok treats that as an authorization problem rather than a monitoring problem: four nouns to describe it, four stages to control it.
Four nouns
Authorization needs a vocabulary
You cannot govern what you cannot name. Every surface in Interlok resolves to these four things and nothing else.
Actor
Identity, not a session
Who or what is acting: a human, an agent, a service account. An actor is a durable identity with a reference like agent:support-bot, so a decision made today still names the same party a year later. Sessions and tokens rotate; the actor does not.
Target
The system that bears the consequence
The place the action lands — a repository, a database, a payment processor, a mailbox. Authorization only means something relative to a target, because the same operation is trivial in one system and irreversible in another.
Action
Classified read or write path
The specific consequential operation, not a coarse permission scope. Every action is classified: reads observe, write paths change the world. Write paths are where gates belong, and where the absence of one is a finding.
Decision
Evidence, not a log line
The record of allow, deny, or hold-for-a-human — attributable to an identity, timestamped, hash-chained. A log line can be edited and explains nothing. A decision record is evidence: it says who determined what, on which inputs, under which policy version.
Four stages
You cannot gate what you cannot see
The stages run in order, and each one produces an artifact the next one depends on. All four are live.
- 01
Discover
LiveHow much reach do our agents already have?
Parse the configuration that grants agents their reach — MCP servers, tool manifests, agent instruction files, CI workflows. Enumerate servers, tools and identities, classify every write path, flag wildcard grants and plaintext credentials.
Artifact A graded posture report (A–F) with findings across seven dimensions, plus a drift comparison against the previous scan.
See how the score is computed → - 02
Gate
LiveShould this specific action happen at all?
Interpose on the write path before it executes. A deterministic policy — first match wins, no model in the path — returns allow, deny, or gate. The runtime calls the gate and only proceeds on an answer.
Artifact A decision record with the matched rule, the policy version, the parameter hash, and its reversibility, chained into the ledger.
Wire the gate into a runtime → - 03
Approve
LiveWhich human agreed to this?
A held action lands in a queue and a named human resolves it. Approvals are quorum-aware and expire, so an unresolved hold fails closed rather than sitting open forever.
Artifact A hash commitment over the action, its parameters and the approver identity — countersigned and chained, so the agreement cannot be rewritten later.
- 04
Reverse
LiveCan we undo it, and can we prove we did?
Every executed action declares its undo path before it runs — compensating action, snapshot restore, or grant revocation — or is labelled irreversible so a human knows the stakes at approval time. Reversals run automatically with retries, bounded concurrency and idempotency keys.
Artifact A reversal receipt with the plan hash and the diff of what changed, chained to the original decision.
Non-negotiables
Principles the product is held to
Deterministic where it counts
No model is consulted in scoring, in policy decisions, or in reversal planning. The same inputs, ruleset and engine version always produce the same output, so a result can be re-derived and disputed on the facts.
Credentials are never stored
When a scan finds a secret, Interlok keeps a fingerprint and the location — never the value. A posture tool that hoards credentials is a new breach surface, not a control.
Append-only or it isn't evidence
Scans, decisions, approvals and reversals are entries in a per-organization hash chain, countersigned with your own P-256 key. Editing history breaks the chain, and the console will show you exactly where.
Policy versions are immutable
Publishing a policy creates a new version rather than mutating the old one. Every decision names the version that produced it, so past decisions stay explainable after the rules change.
Fail closed on the write path
An unreachable gate, an expired hold, or an unmatched consequential action does not silently pass. Reads stay fast; writes wait for an answer.
Attribution over aggregation
Dashboards summarise, but accountability needs a name. Every consequential decision resolves to an identity a person can be asked about.
Start with Discover
Doctrine is only worth anything once it is measured
Paste the configuration that grants your agents reach and get a graded posture report, every ungated write path named, recorded in an append-only ledger.