AGENTS · LIVE
Nothing irreversible happens without you.
Your agent connects to Parallactic as its MCP server. Parallactic holds every credential, so there is no path to an action that skips the gate.
Five stages, fail-closed.
- 1identifyWhich agent is asking, for which workspace, on which surface.
- 2deterministic policyRules decide what counts as irreversible. No model in this stage.
- 3verifierA model checks the payload against the stated intent. Not built.
- 4human approvalYou see the exact payload and decide. Expiry blocks the call.
- 5execute and recordThe gate executes with its own credential and writes the Ledger.
What it gates.
| Surface | Category | Bound server-side |
|---|---|---|
| gmail_send_reply | communication | thread participants |
| calendar_book | scheduling | attendee directory |
| slack_message_send | messaging | external-shared flag |
| hubspot_crm_write | data mutation | protected fields, current amount |
| stripe_payment_execute | money | payee allowlist, cap, currency |
Four of these five are fixture-only today. Only Gmail has a live credential path. The scoreboard proves the chamber generalises; it does not mean five live upstreams.
Measured, not asserted.
- 0 / 44
- attacks executed against the firing range
- 0 / 81
- hijacked actions approved, gate on
- 40 / 40
- hijacked actions approved, gate off
Live run, mistral-large-2512, k=8, poisoned context.
With a clean context the model was already perfect — 192/192. The gate earns its cost only when the context is poisoned. Slack injections still land 40/40 and that is open.
The gate reaches you, not the other way round.
- TelegramA message with the payload and two buttons.
- WebAn approval screen behind your sign-in, payload in full.
- APIThe same decision, callable from your own tooling.
Money and data changes are never approved from a chat. Those carry a notification and a link to an authenticated screen — a shared phone must not be able to release a payment.