Your agents can deploy. That doesn’t mean they should.
ProdPermit turns verified evidence into exact, expiring release authority—bound to one workflow, one artifact, one target and one moment.
Permission is a consequence, not a credential.
A token can authenticate a caller. Green CI can show tests passed. Neither proves an agent has earned the right to change a target.
01 / INTENTAn agent asks.
The requested operation, artifact, target, budget and observation window become explicit.
02 / EVIDENCEThe Ring stays open.
GitLab evidence, policy, target state and protected provenance are collected independently.
03 / AUTHORITYOne exact permit.
A signed permit binds one operation to one artifact, target, attempt, fence and expiry.
04 / OUTCOMEReality gets the last word.
Independent observation determines whether authority can remain, contract, or freeze.
No authority without evidence.
No more authority than you’ve earned.
A control plane between intent and execution.
ProdPermit makes the authorization boundary visible, inspectable and resistant to replay.
Exact identity
Workflow, project, artifact, target and operation are bound before authority exists.
Expiring authority
Permits have bounded windows. Stale evidence never silently becomes permanent power.
Durable fencing
Attempts, idempotency and monotonic fences survive process restarts and reject replay.
Independent outcome
Execution metadata is not runtime truth. Unknown outcomes freeze credit rather than inventing success.
Fail-closed policy
Wrong artifact, target, operation, expired authority or changed delegation produces zero target writes.
Deterministic core
AI can diagnose and recommend. Deterministic code owns hashes, bindings, decisions and authority.
See the authority boundary, not a pitch deck.
The public Trust Lab shows why permits close—or refuse to.
Questions worth asking.
How is this different from CI?
CI checks the candidate. ProdPermit binds evidence to a specific operation, artifact, target, attempt, budget and expiry before execution.
Can I deploy to production?
No. The beta boundary is supervised non-production staging. Production authority is unavailable.
Does signing in grant release permission?
No. Product identity opens a workspace. Protected evidence and an exact permit are separate requirements.
What happens when runtime truth is unknown?
No success credit is earned. Authority cannot expand while the outcome is unresolved.