The firewall for machine action.
EMILIA makes agent accountability verifiable. Before an agent changes money, code, permissions, records, or regulated state, the system requires a receipt. If the action runs, anyone can verify who approved exactly what, under which policy, without trusting EMILIA's server.
Not authentication, not permissions, not anomaly detection. A policy-enforcement point that requires portable proof of human authorization before the world is mutated. Deny by default. Fail closed.
If an agent cannot produce a valid receipt, it cannot change money, code, permissions, data, infrastructure, energy, or physical state.
The gate is deployed by the resource owner — the bank, the cloud API, the database, the robot controller, the grid. An agent that wants to act must bring a receipt the gate verifies. There is no central authority to trust; verification is offline.
The product is the refusal sequence.
A dangerous action is not argued with. It is challenged, verified, bound to real execution fields, consumed once, and turned into a reliance packet. The demo runs locally with generated keys; no EMILIA server is trusted.
node packages/gate/demo.mjs # output: # release_payment, no receipt -> REFUSE 428 (receipt_required) # release_payment, observed drift -> REFUSE 428 (execution_binding_failed) # release_payment, class_a + bound -> ALLOW # same receipt again -> REFUSE 428 (replay_refused) # reliance packet -> RELY
Default packs for high-risk action families.
This is not just an amount threshold. EMILIA Gate treats entire action categories as high risk and binds the material system-of-record fields for each category.
Request → challenge → sign → verify → execute → proof.
Assurance tiers set the floor per action: software — A valid receipt — a software-held key. class_a — A device-bound human signoff (WebAuthn / passkey). quorum — m-of-n distinct humans — the cryptographic two-person rule.
One safe path: reserve, execute, commit, prove.
`gate.run()` makes the ordering hard to get wrong. It reserves the receipt while the action is in flight, commits one-time consumption only after success, releases on pre-mutation failure, and returns the reliance packet.
import { createTrustedActionFirewall } from '@emilia-protocol/gate';
const gate = createTrustedActionFirewall({
trustedKeys: [process.env.EMILIA_ISSUER_PUBKEY],
});
const observedAction = await paymentSystem.describeRelease('pi_123');
const out = await gate.run({
selector: { protocol: 'mcp', tool: 'release_payment' },
receipt,
observedAction,
}, () => paymentSystem.release(observedAction));
if (!out.ok) return out.body; // 428 Receipt Required
return out.packet; // auditor-ready reliance artifactOne gate, every actuator boundary.
Does your integration actually enforce the gate — or are you just claiming it?
CF-1 is the public Consequence Firewall badge. EG-1 is the runnable Gate harness that earns it: point the harness at your dangerous action; if it passes all eight checks, you have a binary artifact instead of a claim. It makes an open PR crisp:“this makes delete_row earn EG-1 / CF-1.”
node packages/gate/eg1.mjs # EG-1 Conformance — does this integration ENFORCE EMILIA Gate? # PASS missing receipt -> 428 # PASS software receipt on Class-A action -> refused # PASS observed execution drift -> refused # PASS valid Class-A/quorum receipt -> runs # PASS same receipt replay -> refused # PASS tampered receipt -> refused # PASS execution proof binds to authorization decision # PASS reliance packet returns verdict "rely" # ✓ EG-1 Enforced (8/8)
Public definition: CF-1 Consequence Firewall conformance.
It does not stop every bad actor. It makes unreceipted systems untrusted.
A bad actor can build an unguarded machine. EMILIA Gate makes legitimate infrastructure refuse unreceipted consequential actions by default — so the parties with leverage (clouds, payment rails, regulators, insurers) can require a receipt. That is how TLS, code signing, and SOC 2 won: not by stopping every bad actor, but by making serious buyers reject systems that lack the control. Necessary, not sufficient.