Protect joins agent identity, signed authority, risk signals and an execution grant in one decision path. In a connected rail, only a matching signed grant reaches the executor.
Bind the request to an agent identity before applying authority.
The decision applies the payee, amount, invoice and time boundary in the mandate.
The signed grant is single-use and short-lived. A connected executor receives no valid grant for an out-of-bound request.
Start in advisory mode and compare signed verdicts with your team's judgement. When the policy is ready, connect enforcement at the payment boundary. The same decision becomes a hard gate only where your executor verifies the grant.
agent → [ protect ] → rail identify · authorize · score · sign · enforce?
A filter gives a recommendation. A firewall gates a connected executor. Protect does both: a signed verdict explains the decision, and a verified grant controls the payment path.