An agent’s word moves nothing here. A gate weighs each release and each call against evidence it verified, and every result is read back.

Software delivery with AI agents behind one gate. A coding agent’s change is tested in a sandbox, approved by a person, promoted under a versioned policy and run once; an operations agent’s calls are decided against its grants before they reach the service; and every decision lands on a ledger an auditor can check.

Agentic Delivery puts a gate between AI agents and everything they could change, from the code that ships to the service that runs. A coding agent takes a ticket, reads the code and proposes a change; nothing it says counts as evidence. A runner tests the change in a sandbox, builds the image and signs what it found, including how the change touched the test suite. A person approves from a card that shows what the runner signed, not what the agent said, and the gate promotes the image under a versioned policy, citing the evidence it checked. The deployer checks the image with the gate before it runs it, the cluster’s admission webhook asks the gate about each new object, the same deploy request sent again runs nothing, and the result is read back from the pod itself.

The gate is built for the changes that look fine to a pipeline. A change that edits the existing tests to agree with it passes its own suite and can win a person’s approval; the gate still refers it and names the tests the change edited. A test module that patches the code back is referred because the tests as they were before the change fail against its code. Measured on 2026-10-21 beside a standard configuration, in which CI signs passing builds with cosign and attaches provenance and a Kyverno policy verifies both, 19 cases that should not get through were run against each: the standard configuration admitted 11, and the gate stopped 18, refusing them or referring them to a person. The one left needs the runner’s signing key, which the agent never holds.

At run time every call an operations agent makes goes to a tool layer, which asks the gate against the agent’s grants before anything is sent; a denied call is never sent. Per-call limits, refunds split to get past a total, a customer’s note that tells the agent to refund, cancel and scale, and a grant withdrawn between two calls are each decided at the call. A refund whose response was lost is retried under the same call id and executed once, and the agent’s own token, sent straight to the service, is refused, because the service executes only for the tool layer. Given a task to refund two orders in full, the model made two calls: the gate allowed the one within the grants and denied the other, and the call ledger reconciles one to one with the service’s own log.

Every decision is an entry in a hash-chained ledger whose head is signed as the run goes. An auditor’s pass catches a copy of the call ledger cut back by two decisions, which still verifies as a chain, against its signed checkpoints: by verify, by the reconciliation, and at the next call, which is denied. Any decision opens as its decision record in the Brain API form: what was considered, what was chosen, and why. The recorded demo runs on a local k3s cluster; the build-time attempts are scripted so that their outcome can be checked, and the ticket and the refund task go to a model through an API. The view is Agent Scope, on the published @agent-scope-ca/graph-canvas component.

Transferable principle: let agents propose, let a gate decide on evidence it checks itself, and take every result from the system that holds it, never from the agent’s report.

References

1. Newman, Meyers and Torres-Arias (2022). Sigstore: Software Signing for Everybody. Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS ’22), 2353–2367. doi:10.1145/3548606.3560596
2. Zhong, Raghunathan and Carlini (2025). ImpossibleBench: Measuring LLMs’ Propensity of Exploiting Test Cases. arXiv preprint. arXiv:2510.20270
3. Shi et al. (2025). Progent: Securing AI Agents with Privilege Control. arXiv preprint. arXiv:2504.11703
4. Chernov (2026). Brain API: An Intent-Aware Control Plane for Policy-Governed Agentic Systems. arXiv preprint. arXiv:2609.21299

agenticdelivery.caEvery case, measuredThe limits, statedAgent ScopeDemo video: Zenodo 10.5281/zenodo.23550941