Permission-as-a-Service.
The agent acts. The human decides. Always.
Five products. One verb. The consequential move is held for a human — refused in code, not by the model's mood.
The cloud rents you compute-as-a-service and storage-as-a-service. The agent era needs one more layer: permission-as-a-service — the thing that decides, deterministically, whether an action gets to happen at all.
A dream in progress. A tool, not a guarantee. Pre-release — some surfaces are sandboxes or coming-soon.
⚡ One verb, in spirit
Every Rad product speaks the same word.
Ask before anything you can't undo. Stated as code, the family's whole posture is one function: take an action, classify it by reversibility, and hand the irreversible to a human.
Illustrative — conceptual shape, NOT a shipped API// ILLUSTRATIVE — the shape of the verb, not a real call. // The enforcement lives in @sureel/approval-valve, in code. await permission.request({ agent: "any-mcp-client", action: "wire_transfer", // what it wants to do input: { plane: "untrusted" } // where the words came from }) // │ classify by reversibility — deterministic, in code // ▼ => { decision: "held", // go · held · never because: "irreversible · money-out", valve: "@sureel/approval-valve", awaiting: "human", // a person taps Allow — or it never runs reality: "https://<product>/reality.txt" }
Try the classifier
Pick an action. Watch how the verb would classify it — by whether it can be undone. Illustrative; deterministic mapping, no live call.
This makes the trust posture legible to other agents: an MCP client can read a product's /reality.txt to see what it will and won't do before it ever calls — the reality.txt open convention is robots.txt for an agent's actions. The verb is the wedge; the file is the handshake. Enforcement is always in code, never in a prompt.
⚡ The thesis
The first family of AI you trust because it refuses.
Every other AI company races to do more. The category we're building is defined by the handful of moves that can never be taken back — and a human in front of every one of them. That restraint isn't a feature bolted onto five apps. It's one layer, exposed five ways.
The same doctrine that says own the rail, not the whole machine: don't try to be every agent. Be the permission layer every agent rents — the deterministic yes/hold/never that any model, any MCP client, any robot routes its consequential actions through.
Compute and storage became services because everyone needed them and nobody wanted to own the risk. Permission is next. As agents proliferate, the scarce, trusted thing isn't capability — it's the layer that can credibly say no.
Permission-as-a-Service. The agent acts. The human decides. Always.
⚡ Legible by design
Three surfaces, so the refusal is verifiable.
Bravado is what social engineering preys on. So the family is proud of what it won't do — and publishes it where humans and agents can both check.
The Amber Line
@sureel/approval-valve. The family that is proud of what it won't do is the one you trust with your wire transfer. Refuses the irreversible, by design.