What is an authority layer? (And why IAM isn't one)
IAM grants access. An authority layer authorizes each consequential action before execution — with replayable evidence after.
Every week another enterprise deploys agents that can move money, change production, or rotate credentials. IAM still answers who can authenticate. Nobody answers whether this exact action should run right now.
An authority layer is the control plane for that question. It evaluates proposed actions against policy, risk context, and approval state — then returns ALLOW, DENY, or APPROVAL_REQUIRED before downstream systems mutate.
ALLOW means policy permits execution. DENY means policy blocks. APPROVAL_REQUIRED means a named human must authorize this specific action — single-use, expiring, bound to the action hash.
Every outcome produces evidence. Auditors replay decisions; they do not reconstruct them from log fragments.
Humbleaf is the enterprise authority layer; AgentChain is the authority engine underneath. Start with an Authority Surface Map — no credentials — to catalog which workflows need guards.
