Skip to main content

Transparency

Evidence and enforcement boundaries

RANKIGI has two separate products with different failure contracts. The Authority gateway enforces governed actions in customer infrastructure. The Passive observer forwards first and records what it can observe; it does not enforce.

Implementation is testable; live GitHub acceptance has not run.

Section 1

Authority gateway

  • In enforcement mode, a required deny or unknown decision refuses the action before provider contact.
  • Durable reservations constrain concurrent use of a loaded Authority Grant before dispatch.
  • Provider-contact claims require a recorded gateway attempt; effect claims require applicable provider-side reconciliation.
  • The customer-run gateway owns credential resolution and its PostgreSQL ledger. Hosted RANKIGI does not hold the governed provider credential.

Section 2

Passive observer

  • The observer forwards first and observes second. Observation failure must not block the wrapped agent.
  • It records submitted metadata and available responses, but cannot establish bounded capture completeness outside the observed surface.
  • It never holds the governed provider credential and must never be presented as enforcement.

Section 3

What neither product establishes

  • The agent's intent, reasoning, trustworthiness, or the wisdom of an action that was correctly within scope.
  • Legal admissibility, regulatory approval, or guaranteed compliance.
  • Universal completeness across credentials, providers, accounts, devices, people, or paths outside the declared boundary.

Section 4

Active design-partner boundary

  • One organization, one customer-owned GitHub App, one selected GitHub Cloud repository, work.issue.create, and one gateway replica.
  • The GitHub App private key stays in the customer's AWS Secrets Manager. Neither the agent nor the hosted Control plane receives it.
  • A create response may support provider_accepted. Exact independent retrieval may support effect_confirmed. This pilot cannot emit settled or reversed.
  • An ambiguous response remains indeterminate until bounded recovery resolves it; the gateway must never send a replacement create request.
  • The pilot does not claim general availability, high availability, regulatory compliance, or support for additional providers and actions.

For specific legal or regulatory determinations, consult qualified counsel.