Set authority once. Let agents work.
A human or institution defines a finite operating mandate. Agents work unattended inside it. EMILIA Gate enforces each consequential unit of work before money, code, permissions, records, or infrastructure can change.
Define a finite mandate once. Gate enforces every consequential unit of work on the protected path.
Not every action needs a human. Every consequential action needs valid authority. Protocol proves. Gate prevents.
Payments separated authorization from movement. Agent actions still do not.
A card system does not confuse identity, authorization, movement, settlement, and dispute evidence. Most agent stacks collapse those facts into one tool call and one log.
Authorization is distinct from movement.
Stable operation identity can prevent a duplicate.
The record binds who, what, and how much.
Settlement and disputes have separate evidence.
A broad credential and policy check may be treated as the yes.
The exact approved action may never be frozen.
A timeout may trigger a blind second attempt.
The log is written after the consequence.
EMILIA is not a bank, settlement rail, or clearing network. The analogy is the separation between permission, provider entry, and evidence of effect.
Identity tells you who. Authority defines the work.
Identity, OAuth, policy engines, and monitoring remain essential. None alone defines the agent's finite mission, limits, evidence, expiry, and exception rules—or proves that this exact consequential unit of work may enter now, once.
Open discovery creates the paid boundary.
The free map earns trust. Gate sells preventive control. The open Protocol keeps evidence portable. Assurance makes the deployed boundary operable.
Evidence can travel without becoming permission.
Accepted evaluation evidence may qualify one measured candidate and assignment. The resource owner still decides whether the exact protected action may proceed.
Qualification travels. Authorization stays local. Gate controls the consequence.
Qualification is not authorization, certification, deployment evidence, or proof of a successful effect.
One exact action. One use of authority. No invented certainty.
Start where a human decision already exists.
Payer adverse medical-necessity determinations contain recurring review and appeal events, concrete action fields, and high consequence. EMILIA does not make the medical judgment. It binds the buyer's required licensed-review evidence to the exact adverse action at the protected boundary.
No valid licensed-review evidence, no adverse determination.
Protect one consequential workflow.
Agent and MCP vendors plus consultancies create distribution leverage. Payments, privileged infrastructure, energy, and government are expansion paths—not claimed traction.
Expand by protected workflow, not by vague platform promise.
Money
Payment releases, beneficiary changes, treasury operations
Code
Production deploys, credential rotations, permission escalation
Records
Payer determinations, benefit routing, accountable overrides
Infrastructure
Bounded energy commands and other high-consequence actuators
Anyone can copy a schema. They cannot copy a security case by changing the logo.
EMILIA’s differentiation is not proprietary cryptography. It is a composed, machine-rerunnable argument that the whole path holds together: challenge, canonical action, human ceremony, issuer and authority pins, revocation, one-time consumption, and execution.
↓ canonical action
↓ human ceremony
↓ issuer + authority
↓ revocation
↓ consumption
↓ execution
Tamarin tests this as one symbolic protocol under a Dolev-Yao attacker with full network control, rather than assuming separately checked pieces compose safely.
execution_requires_full_compositionVERIFIED · ALL TRACESExecution requires challenge, exact action, approvals, pinned authority, revocation, and consumption to compose.
no_issuer_launderingVERIFIED · ALL TRACESA presenter cannot turn its own key into an accepted issuer by relabeling the artifact.
no_cross_action_profile_or_audience_replayVERIFIED · ALL TRACESValid evidence cannot be transplanted to another action, profile, or relying party.
initiator_cannot_self_approveVERIFIED · ALL TRACESThe actor initiating an action cannot fill the human-approval seat.
strict_registry_view_is_exactVERIFIED · ALL TRACESAuthority evidence must match the exact registry checkpoint pinned by the relying party.
injective_execution_with_consumptionVERIFIED · ALL TRACESOne consumed authorization maps to at most one checked execution.
We deliberately remove controls and ask Tamarin to find the failure.
unchecked_composition_is_injectiveRemove one-time consumption and Tamarin finds a same-receipt replay.
unchecked_registry_view_is_currentRemove exact registry-view binding and Tamarin accepts a stale or equivocating authority view.
Open does not mean interchangeable.
Nothing prevents another team from implementing the open format. That is the distribution strategy. But a compatible envelope is not an equivalent system. Equivalence means reproducing the composed proof, strict verifier behavior, negative vectors, durable consumption, release evidence, and every assumption and exclusion. Each discovered failure becomes a permanent, machine-rerunnable obligation. That body of evidence compounds with every release.
Broader executable evidence: 26 TLA+ invariants · 35 Alloy facts + 32 assertions · 8,865 automated cases · 331 current conformance vectors.
Scope remains explicit: TLA+ and Alloy model bounded state and relational properties; Tamarin uses symbolic perfect cryptography and pinned-root assumptions. These are not proofs of AI behavior, WebAuthn internals, parser correctness, legal compliance, or deployment completeness.
More autonomy.
Finite authority.
Run the local map, choose the consequence that matters, and place Gate where the credentialed action actually enters the system of record.