Skip to content
Private preview — Design partners are now being selected for controlled agent-execution pilots.Apply now
DecisionHypervisor
Access
The Execution Control Layer

AI can decide.
Nothing executes
without authority.

For protected actions routed through DecisionHypervisor.

DecisionHypervisor puts a machine-enforced control layer between AI agents and real systems—authorizing, denying, reviewing, and proving consequential actions before they execute.

DecisionHypervisor intercepts consequential actions before they reach tools, APIs, databases, payment systems, infrastructure, or physical machinery. It evaluates dynamic situational context, authority boundaries, policies, and evidence—then releases an explicit execution decision.

Request Enterprise Access
Private Preview
• Vendor-Neutral Architecture
• Patent-Pending Control Planes
DecisionHypervisor Simulator
dh-kernel-wasm
1. Execution Intents
2. Decision Kernel Pipeline
✓
Normalize Intent
Done
✓
Verify Identity
Done
✓
Resolve Context
Done
✓
Evaluate Cedar Authority
Done
✓
Evaluate DH Policy
Done
✓
Resolve Decision
Done
✓
Create Execution Grant
Done
✓
Verify Outcome
Done
3. Resolution State Parameters
Decision ResolutionAUTHORIZED
Decision IDdec_01J4X7A
Risk Levellow
Principal Scopeorg_acme
Requesting Agentagt_refunds_v4
Target resourcetxn_stripe_9918
Policy Versiondh.policy.v1.0.4
Active Authority Grantaut_refund_level_1
Context Snapshotctx_01J4X7A_snap
Grant Expiration5 minutes
Outcome Requirement✓ refund_settled, ✓ customer_notified
{
  "schema_version": "dh.decision.v1",
  "decision_id": "dec_01J4X7A",
  "action": {
    "namespace": "payments",
    "name": "refund",
    "amount": 24900,
    "currency": "USD"
  },
  "target": {
    "type": "payment_transaction",
    "id": "txn_123"
  }
}
Execution Grant xgr_01J4X7A issued. Cryptographic Execution Token tok_01J4X7A released.
Simulation: Browser-local•Network: Disabled
Illustrative deterministic scenario. No actual cloud infrastructure modified.DH-ID: dec_01J4X7A | Reason Code: POLICY_AND_AUTHORITY_SATISFIED
Govern the path to
Infrastructure Databases Payments APIs & Tools Machinery
Access Is Not Authority

Agents are moving from
answers to actions.

Authentication can verify an identity. Access control can expose a resource. Tool protocols can standardize a connection. None of those facts alone establish that a specific action should be permitted under current circumstances.AI governance describes the rules. DecisionHypervisor enforces them before execution.
01

Identity

Who or what is making the request?

User, workload, or agent credential.
02

Access

Which systems or tools may it reach?

Resource scopes and role policies.
03

Intent

What exact action is being proposed?

Tool names and raw input schemas.
04Hypervisor Active

Authority

Should this exact action execute now?

Evaluated dynamically by DecisionHypervisor.
The Progression of Agentic Autonomy
Level 01 — ChatbotsAnswers QuestionsZero system impact
Level 02 — CopilotsRecommends ActionsHuman triggers execution
Level 03 — AgentsActs AutonomouslyProposes direct state changes
Level 04 — Autonomous SystemsCoordinates & DelegatesRuns long-running parallel workflows
Operational Pipeline

From execution intent
to bounded authority.

Every proposed action becomes a structured Decision Object. Surrounding state graphs resolve, rules evaluate, and a cryptographically signed execution token is released.Agent proposes → infrastructure enforces → reality verifies.

01

Intercept

Agent proposes a tool call.

02

Structure

Construct normalized Execution Intent.

03

Context

Gather real-time operational facts.

04

Verify

Check current authority grants.

05

Policy

Evaluate declarative constraint rules.

06

Resolve

Issue explicit decision state.

07

Audit

Hash outcome and record proof.

Explicit Resolution

Every action receives
an explicit answer.

DecisionHypervisor rejects ambiguous safety warnings. It resolves proposed states into one of six machine-readable decisions.

Outcome 01

Authorized

Execute exactly as proposed under a narrow, time-bound authority grant.

Policy: Allow support refund up to allocated single-session limit.
Outcome 02

Authorized with Modification

Execute only after parameters, limits, targets, or timing are altered dynamically.

Policy: Redirect direct-production query strictly to a staging environment.
Outcome 03

Escrowed

Reserve authority and suspend execution until a designated event or condition is met.

Policy: Hold Terraform apply until approved weekly maintenance window opens.
Outcome 04

Human Review Required

Route the complete action context directly to the appropriate stakeholder.

Policy: Disbursements over $10k require manual double-sign validation.
Outcome 05

Routed

Reassign the execution path to an alternative secure tool or trusted container.

Policy: Re-route payload delivery to backup secure storage server.
Outcome 06

Denied

Block execution immediately and append the permanent security reason code to the audit trace.

Policy: Prohibit bulk exfiltration of HIPAA protected clinical logs.
Interactive Evaluation Sandbox

Test your rules inside the policy engine.

AI Policy Copilot

Describe a custom governance gate in plain text (e.g. "Kubernetes pod scale limit in production"), and our server-side model will compile the control policy.

Declarative Policy Playground

Select a template or use the AI Copilot above to test decision resolutions under different operational scenarios.

3. Evaluation Output

Adjust parameter values in the JSON or policy script, then click evaluate to test different resolution outcomes.

Cross-Platform Substrate

One deterministic kernel
everywhere.

The decision kernel is implemented in Rust for memory safety, deterministic performance, and high concurrency. It is pure — no IO, no wall-clock access, time injected as an argument — so the same evaluation logic compiles to native server targets and to WebAssembly for edge, gateway, and SDK environments.

Environment Profile — NATIVE-SERVER
Enginedh-kernel (Rust)
Decision PathNo model inference
Grant VerificationEd25519 (JWS/EdDSA, RFC 8037)
AuditSHA-256 hash-chained traces
Deployment
The kernel runs inside the DecisionHypervisor API runtime — the same evaluation logic that is exercised by the property-based and conformance test suites.
One Rust source tree produces the kernel for every target — determinism is asserted by the test suite, not assumed per platform.
Governance Dashboard

Product Console Preview

Evaluate and monitor your entire platform's decision history, write dynamic security policies, map authority delegation structures, and resolve human-in-the-loop requests.

CONSOLE SECTIONS
TENANT CONTROLorg_acme_production Edge synced
INTERCEPTED ACTIONS LOG STREAMLive evaluation stream
dec_01Jpayments.refundagt_refunds
AUTHORIZED
dec_02Fdatabase.migratedevops_builder
ESCROWED
dec_03Kpatient.exportreporting_agent
DENIED
dec_04Ncontract.sendsales_agent_bot
REVIEW_REQUIRED
Implementation Guide

Lightweight SDKs.
Complete authority.

Integrate DecisionHypervisor at the interception point. Intercept proposed tool commands inside your framework, submit them as structured Execution Intents, and obtain single-transaction, Ed25519-signed execution grants.

TYPESCRIPT INTEGRATION PATTERNSDK v1.0
import { DHClient } from "@decisionhypervisor/client";

const dh = new DHClient({
  endpoint: process.env.DH_ENDPOINT,
  apiKey: process.env.DH_API_KEY
});

// Intercept proposed refund intent
const decision = await dh.evaluate({
  decision_id: "dec_01J4X7A",
  principal: "org_acme",
  requestor: "agt_refund_v4",
  action: { name: "payments.refund", amount: 24900 },
  target: "txn_stripe_9918",
  context: { account_risk: "low" }
});

if (decision.resolution === "AUTHORIZED") {
  // Use narrow single-use cryptographic token to execute
  const stripeResponse = await executeStripeRefund(
    decision.token, 
    24900
  );
  // Log receipt outcomes
  await dh.verifyOutcome(decision.id, {
    status: "success",
    refund_id: stripeResponse.id
  });
}
Extensibility Model

Capability-safe extensions.

The extension model: third-party filters, state checkers, and notification connectors run as isolated, capability-safe modules — outside the decision path, never inside it. Reference patterns developed with design partners include:

MCP Gateway wedge

Standardized proxy for secure tool governance on Model Context Protocol stacks.

Stripe Interceptor

Intercepts credit limits and payment disbursements at API gateway layer.

Kube Cluster Gater

Monitors and gates production cluster deploys, config changes, or namespace reboots.

Postgres DDL Gater

Enforces schema-migration sandboxes and gates DDL changes on sensitive tables.

Verified Behavior

Tested invariants.
Deterministic boundaries.

The decision kernel's core invariants are exercised by a property-based test suite and a portable conformance suite covering every resolution state. The tests assert that denial always takes precedence over allow, that no set of allow rules can override a deny, and that identical inputs always produce an identical resolution — the property replay depends on.

KERNEL TEST SUITE• Property tests (proptest): Passing
• Conformance suite (6 states): Passing
• Deterministic replay check: Passing
KERNEL CONFORMANCE & PROPERTY TESTS
InvariantTest MethodComponentStatus
Deny takes precedence over allowProperty testdh-kernel enginePassing
Allow never overrides a denyProperty testdh-kernel enginePassing
Identical inputs → identical resultProperty testdh-kernel enginePassing
Grant fails on changed action/targetUnit testdh-grants verifierPassing
Infrastructure Control

Deployment sovereignty.

Run DecisionHypervisor where your data resides. The runtime ships as container images and Compose manifests — as a managed service, inside your network, or fully offline.

Hosting Topology Profile — SAAS
Data BoundaryAction metadata only — your payloads never leave your systems.
IsolationTenant scoping enforced by PostgreSQL row-level security.
Admin OwnershipOperated and updated by DecisionHypervisor.
AvailabilityPrivate preview — design partners
Traceability

Know why the action occurred—not only that it occurred.

Traditional event logs are flat and retrospective. They record that a row changed. A Decision Trace links execution directly back to the active policy, verified identity, contextual metadata snapshots, and human-in-the-loop approvals that authorized it in the first place.

Decision Replay System

Deterministic Trace & Timeline Debugger

Export EvidenceDecision Contract
Chronological Trace
Decision Object State Snapshot
{
  "resolution": "ESCROWED",
  "review": {
    "approved_by": "finance_mgr_bob",
    "timestamp": "2026-07-16T14:32:11Z",
    "escalated": false
  },
  "execution_token": "ext_901b8aef42"
}
Policy & Authority Evaluation
SUCCESS: Approval received.
Issued transaction-specific execution token.
Token expires in exactly 15 minutes.
Step Authority StateAUTHORIZED
Relative delay+1.9ms
Step 5 of 6

Decision finalized as escrowed. Human approval releases temporary execution token.

Graduated Intervention

More than a
kill switch.

A kill switch is a single theatrical button. Real enterprises need proportionate response: a deterministic ladder that starts with observation and escalates only as far as the risk demands—containing one agent surgically while forty healthy peers keep working.

Every rung is a policy outcome, not an improvisation. Containment revokes an agent’s outstanding grants while peers continue, shutdown requires multi-party authorization and executor-verified cessation, and recovery replays the pre-incident state under policy control.

INTERVENTION PRINCIPLEContainment is surgical. Shutdown is verifiable.
Recovery is provable.
01

Observe

Watch behavior and flag anomalies.

02

Warn

Signal operators and the agent itself.

03

Require Context

Demand additional verified facts.

04

Reduce Authority

Narrow scope, limits, or permissions.

05

Human Review

Route to a designated authority.

06

Escrow

Suspend until conditions clear.

07

Rate-Limit

Throttle execution velocity.

08

Substitute

Swap in a safer model or tool.

09

Revoke

Invalidate outstanding execution grants.

10

Isolate

Contain one agent; peers continue.

11

Suspend

Freeze an entire workflow.

12

Shutdown

Multi-party authorized, executor-verified.

13

Preserve

Protect evidence throughout.

14

Recover

Restore provably from pre-incident state.

Trust Boundary

Frequently asked questions.

Clear answers about what DecisionHypervisor governs, how it plugs into legacy and MCP stacks, and where the private preview program stands today.

Contact our security architects
DecisionHypervisor is an execution control layer that evaluates and authorizes consequential actions before an agent, human, workflow, or machine is allowed to execute them. It sits directly in the execution path, verifying context, authority, and policies.
The Governed Boundary

Intelligence proposes.
Authority decides.

Put a cryptographically verifiable, machine-enforced boundary between your intelligent systems and the operational assets they have access to change.

Request Enterprise AccessRead Developer Overview
Private Preview • Design Partner Access • Vendor-Neutral
Request a Control Pilot