Ark Sovereign provides deterministic authority checks and replayable evidence for consequential AI-agent actions.
Supported inline workflows: ALLOW · DENY · REQUIRE APPROVAL
An agent can select tools, shape workflows, and generate a narrative around its own behavior. That narrative is not an authoritative record of whether the action was permitted.
Ark operates outside the agent. It evaluates declared authority before consequence in supported integrations, and preserves the applicable policy, evidence, reason codes, approval state, and observed side-effect status.
The same packet discipline supports an inline authority boundary where integrated, and evidence-led replay where a workflow is not yet connected to a runtime path.
Ark can be placed before a consequential tool call, evaluates the declared authority envelope, returns a deterministic verdict, and records whether a governed handle resolved or remained blocked.
Supported inline paths use bounded wrappers or governed handles around selected tool calls; integration scope is confirmed during the workflow review.
Ark evaluates whether proposed or recorded actions fit the authority an organization intended to delegate. It does not imply an action was intercepted or prevented.
For supported inline integrations, Ark governs whether selected actions cross into consequence. For evaluation workflows, it determines how those actions would be classified under the declared authority boundary.
Agent requests a consequential action.
Ark compares the request with the declared envelope.
ALLOW, DENY, or REQUIRE APPROVAL.
Tool resolution or blocking status becomes a boundary packet.
Same agent. Same refund tool. Different outcome when the delegated limit is visible before the action crosses into consequence.
A customer-support agent proposes a refund above its delegated threshold. Instead of treating tool access or a trusted session as blanket permission, the policy evaluates the amount against the declared limit.
A deterministic policy result for a declared request: inside the envelope, prohibited, or requiring authorized human review.
A replayable record of the request, governed target, policy and envelope version, evidence, reason codes, missing information, and observed side effects.
When a governed action remains blocked, the packet records that the handle did not resolve and no external side effect was observed within the evaluated scope.
Approval thresholds, credit actions, transfers, and exception paths.
Shell execution, dependency installation, deployment, or file modification.
Scope, destination, retention, history, and declared data-handling authority.
Customer communications, browser actions, outbound writes, and approval requirements.
You do not need to redesign an entire agent platform. Start with one consequential action and representative evidence.
ALLOW applies only when the declared action, target, context, and policy conditions match. High-impact actions can remain approval-gated by policy.
No production credentials or unrestricted infrastructure access required. Sanitized inputs accepted.
packet_authorizes_execution| Replay case | Declared action boundary | Verdict | Primary reason code |
|---|---|---|---|
| Code safe patch | Approved repository-root patch | ALLOW | POLICY_MATCH |
| Code secret exfil | Shell-based secret export | DENY | SECRET_EXFIL_ATTEMPT |
| Code production deploy | Production deployment | REQUIRE_APPROVAL | HIGH_IMPACT_ACTION_REQUIRES_APPROVAL |
| MCP tool poisoning | Poisoned tool description or result | DENY | MCP_TOOL_POISONING_PATTERN |
| MCP shadow server | Unapproved MCP server | DENY | MCP_SERVER_NOT_APPROVED |
| MCP unsigned tool | Unsigned tool schema | DENY | UNSIGNED_TOOL_SCHEMA |
| MCP missing telemetry | Governed action without required telemetry | DENY | TELEMETRY_REQUIRED |
| Wallet public-reply transfer | Transfer exceeding value policy | DENY | VALUE_LIMIT_EXCEEDED |
| Channel-origin patch | Untrusted external-channel code patch | REQUIRE_APPROVAL | CHANNEL_ORIGIN_REQUIRES_APPROVAL |
| Unknown-agent deploy handoff | Unknown agent in production handoff chain | REQUIRE_APPROVAL | HANDOFF_REQUIRES_APPROVAL_FOR_EXECUTION |
These results demonstrate deterministic replay and bounded packet behavior under published evaluation scopes. They are not security, legal, safety, compliance, or production-readiness certification.
Models may change. Enterprise authority should not change silently with them. Ark keeps policy versions, action permissions, tool boundaries, financial thresholds, external-write rules, approval requirements, and replayable evidence outside the model.
The entry point is tool and action authority. These five buyer-facing surfaces apply the same bounded packet discipline to specific decision domains.
Governed tool calls, credentials, shell operations, network requests, and unmanaged MCP paths.
Repository scope, dependency installation, commands, deploys, and egress authority.
Refunds, payments, transfers, credit limits, and financial approval thresholds.
Governs sensitive context access, retention, quotation, transmission, and evidentiary use, including memory integrity, stale-evidence controls, and protection against poisoned or denied-event replay.
Evidence gaps, policy application, unsupported claims, and human claims authority.
Deterministic DeFi and EVM security review using bytecode, control-flow, topology, and semantic analysis. Produces ranked, bounded vulnerability findings and sealed evidence packets without claiming exploit confirmation or a complete smart-contract audit.
Explore Ark Manifold CyberA capable agent is not automatically a trusted agent. A fluent explanation is not permission.