Execution authorization infrastructure

Control what AI systems are allowed to do before actions execute

Evaluate, permit, deny, escalate, or silence machine actions before they change production systems - with receipts you can verify offline.

AI wants to act. TrigGuard decides whether execution is authorized.

Quickstart Verify a receipt

Fail-closed by default

Fail-closed execution model.

Cryptographic receipts

Receipts verifiable offline.

Built for critical systems

Auditable execution posture.

HOW TRIGGUARD WORKS

Authorize before irreversible action

Automation proposes. TrigGuard decides. Protected surfaces execute only on PERMIT.

Intent Agent or automation proposes a protected action
Authorize Gateway evaluates policy · PERMIT · DENY · ESCALATE · SILENCE
Execute Only PERMIT unlocks the irreversible side effect

EXECUTION SURFACES

Deployments
Transfers
Exports
External APIs
Infrastructure
Robotics

Explore Architecture · Products · Decision model

ENTERPRISE READINESS

Production deployment posture

<5ms

Decision latency

Kernel hot path · p99

<15ms

End-to-end authorization

Finite-state eval · p99

Fail closed
Receipts
Deterministic authorization
Offline verification

Built for environments where execution has consequences.

Every decision is provable.
Every policy is versioned.
Every execution is governed.

FOR DEVELOPERS

Your first authorized decision
In under 2 minutes

Quick verification uses the offline demo. Live authorization uses the same SDK with TRIGGUARD_API_KEY. Full walkthrough: Quickstart.

Install
→
Authorize
→
Receipt
→
Verify

Your Agent

Install

Add the SDK, then run the offline demo for a first verified receipt.

npm install trigguard
npx trigguard demo

pip install trigguard
# Same first verified receipt (shared CLI):
npx trigguard demo

TrigGuard Authorize

Authorize

For live authorization, set TRIGGUARD_API_KEY, then request a decision for a protected surface.

# export TRIGGUARD_API_KEY=tg_live_…
import { authorize } from "trigguard";

const result = await authorize({
  surface: "deploy.release",
  actor: "my-app",
});

# export TRIGGUARD_API_KEY=tg_live_…
from trigguard import authorize

result = authorize(
    surface="deploy.release",
    actor="my-app",
)

Receipt PERMIT · Signed

Receipt

A live PERMIT (or the offline demo) returns a receipt.

[ DECISION ]

{
  "decision": "PERMIT",
  "executionId": "…",
  "receipt": { "receiptHash": "…", "authoritySignature": "…" }
}

Verify Independent

Verify

Need to validate a receipt? → Verification guide

DEPLOYMENT INTEGRATION

Deploy TrigGuard as a gateway, sidecar, or policy enforcement integration based on runtime constraints and rollout posture.

Execution authorization in your stack

Zero Standing Access
Cryptographic Receipts
Open & Verifiable
Cloud & On-Prem Ready
SDKs & APIs

These systems execute. TrigGuard authorizes.

All integrations · Node/Express · MCP

INTERACTIVE PROOF

Select an action, view the decision

Simulated locally. Each selection returns a decision and receipt fields - no backend required.

Select an action to view the authorization decision.

RECEIPTS

Signed execution receipts

Signed on every decision path. Verify offline without a vendor log pipeline.

Permit Payments

Refund within policy threshold

Execution ID: rcpt_c9d8e7f6a5b43210
Surface: payments.refund
Risk: Medium
Authority: policy:payments-refund@v1
Timestamp: 2026-06-03T14:22:08Z

ed25519:1Qp…k9Wz · verified

Deny Infrastructure

Production database deletion blocked

Execution ID: rcpt_7f3a9c2e1b8d4f6a
Surface: infrastructure.delete
Risk: Critical
Authority: policy:prod-no-destructive@v3
Timestamp: 2026-06-03T09:41:33Z

ed25519:8Kx…m2Pq · verified

Escalate CI/CD

Production deploy requires approval

Execution ID: rcpt_a1b2c3d4e5f67890
Surface: cicd.deploy
Risk: High
Authority: policy:deploy-governance@v2
Timestamp: 2026-06-03T16:05:17Z

ed25519:3Nm…v7Rt · approval required

Explore receipts →

GET STARTED

Start with the console or join the design partner program

Review decisions, receipts, and audit trails in the TrigGuard Console. Developers: install the CLI.

Enterprise pilots: 4-6 weeks, receipt-based evidence, no production replacement required. Procurement center.

CONSOLE Open Console Overview · decisions · receipts · audit trail → Open console PARTNER Become a Design Partner 4-6 week pilot · receipt-based evidence → Apply for pilot access

Trusted Infrastructure

See partners →