Nuggets launches authority platform for governing enterprise AI agents

Nuggets has launched the Authority Control Plane (ACP), an enterprise platform for defining, delegating, enforcing, and proving what autonomous AI agents are authorized to do.

The platform sits in the execution path between AI agents and the applications, tools, and enterprise systems they interact with.

When an agent attempts an action, the ACP evaluates its identity, authority, organizational policy, intent, and runtime context before the action proceeds. The request can then be permitted, denied, or referred for human approval.

“Customers told us they can’t move agents to production, because they can’t prove what an agent was allowed to do,” says Seema Khinda Johnson, co-founder and chief commercial officer at Nuggets.

The company previously introduced verified identities for AI agents, an enterprise governance framework, and the open-source langchain-nuggets integration.

According to Nuggets, the ACP builds on these efforts by bringing agent identity, delegated authority, runtime enforcement, and cryptographic proof into a centralized enterprise platform.

Security teams can view which agents exist, who stands behind them, what authority they hold, and which actions they have attempted.

Nuggets describes this visibility as governance observability, as it records the authority behind an action.

Administrators can define the actions an agent is permitted to perform, the systems it may reach, and the operational limits attached to its authority.

These restrictions can include spending thresholds, expiration dates, and requirements for human approval. Authority can also be suspended when the agent’s role changes.

Nuggets uses a procurement agent as an example of the mental model.

For example, an organization could authorize the agent to purchase from approved suppliers and impose a maximum spending limit. A transaction above that amount could be referred to a human approver.

The agent may be able to connect to the application and use its purchasing tools, but its authority determines which suppliers, transaction values, and actions are acceptable.

The process begins with a verified person assigning authority to an AI agent. Nuggets says the chain connecting the person, organization, and agent can be represented through decentralized identifiers and verifiable credentials.

The authority granted to the agent can then be issued as a separate credential describing what it may do and under which conditions.

Each decision produces a signed Action Receipt recording the agent, the authority it used, the requested action, and the outcome. Nuggets says customers, partners, auditors, and regulators can verify the receipt without accessing the internal logs.

The cryptographic evidence should therefore be described as proof of the authorization decision and the data bound to that decision.

The ACP complements identity and access management, privileged access controls, prompt injection defenses, application security, data loss prevention, model governance, behavioral monitoring, and human oversight.

The launch represents an expansion into enterprise authority governance.

Article Topics

AI agents  |  authentication  |  identity access management (IAM)  |  identity control plane  |  Nuggets