The category
Pre-Execution Accountability Infrastructure
Audit logs, IAM, and GRC dashboards tell you what happened. EMILIA decides what is allowed to happen — binding identity, authority, policy, the exact action, and a named human’s signoff before an irreversible action executes. Post-hoc governance is forensic archaeology; this sits in the execution path.
Why the existing control stack falls short
Audit logs
Forensic archaeology. They record the action after it executed — the money already left. A log written by the same system whose integrity is in question is testimony, not independent evidence.
IAM / OAuth
Proves who the actor is and that they hold a scope. It does not prove a named human authorized this exact action, now. Once a token is exfiltrated or a session hijacked, every downstream action is silently authorized.
GRC dashboards
Govern from above — inventory, policy, mapping, reporting. Useful, but they do not sit in the execution path. They know what happened; they do not stop the thing before it happens.
Human-in-the-loop
Unfalsifiable as usually built. "A human reviewed it" with no artifact bound to the exact action, verifiable by a third party, is theater. The approval has to produce evidence.
The model: Observe → Verify → Own → Seal
- Observe. See every irreversible action that would require stronger approval — report-only, zero blocking. The safe on-ramp.
- Verify. Bind identity, authority, policy, and the exact action context before execution. Allow, allow-with-signoff, or deny.
- Own. When policy requires it, a named human signs off on the exact action on their own device. Profiles can require initiator exclusion and distinct-human quorum.
- Seal. Emit a portable, tamper-evident receipt anyone can verify offline — no trust in the operator, no backend call.
Where it applies
Payments & treasury
Vendor bank-account changes, wire releases, payee onboarding — the BEC and authorized-push-payment vectors.
Government benefits
Payment-destination redirects, eligibility overrides, operator actions — appeal-ready by construction.
AI agents
Irreversible tool calls at the MCP boundary — prompt injection can change what an agent proposes, not what a named human signed.
The receipt proves a named human authorized this exact action under a stated policy before it executed, verifiable offline. It does not assert the decision was correct; one-time-use and revocation are relying-party server state.