Frequently Asked Questions
The questions we hear most from the people who have to evaluate, deploy, or answer for Runtime Authority.
What is Runtime Authority?
Your organization defines who, or what, holds authority to act, the same way it already does for employees. Runtime Authority decides that: it evaluates, immediately before an autonomous AI agent's action executes, whether the action falls within the authority your organization has already delegated. Not a policy on file, not a log entry after the fact, but an authorization decision, made at the moment it matters. See Platform for the full picture.
How is this different from IAM or access control?
Identity and access management answers who someone (or something) is, and what systems it can reach. It doesn't evaluate whether a specific action, right now, is actually within that identity's delegated authority. Runtime Authority sits on top of identity, not in place of it: it answers the second question, not the first.
Is Runtime Authority tied to a specific LLM, agent framework, or orchestration platform?
No. It's decoupled from both your AI systems and your enterprise systems, and evaluates the signed intent an agent sends regardless of what produced it. Whether your agents run on LangGraph, CrewAI, AutoGen, an MCP server, or a direct model API call doesn't change how it's evaluated.
Is this a governance tool, or something new?
Something new. It's not an AI governance platform: it doesn't decide what your policy should say. Runtime Authority evaluates the governance you already have, at the moment an agent tries to act, a distinct job from deciding what that governance should be in the first place.
Does PayReality decide what AI agents are allowed to do?
No, your organization does, the same way it already decides what any employee or system is allowed to do, through delegation of authority, approval matrices, and policy. Runtime Authority doesn't originate that decision; it evaluates it, at the exact moment an agent tries to act. In short: AI reasons, your organization authorizes, Runtime Authority decides.
Does PayReality use an AI model to decide whether an action is authorized?
No. Evaluation is deterministic: the same policy and the same input always produce the same decision. Runtime Policies compile into rules an engine evaluates, not a judgment call a model makes. We deliberately don't use one AI model to judge whether another AI model's action is authorized.
Does this replace human review and approval?
No, it routes to it. Human Review is one of the three possible outcomes of every evaluation (alongside Allow and Deny), for exactly the actions your policy says need a person. What changes is that the routing decision itself is made automatically, not left to whether anyone remembered to check.
Do we have to rebuild our existing approval matrices and Delegation of Authority documents?
No. The Authority Graph and Runtime Policies are built from the governance you already have (your existing Delegation of Authority policy, approval matrix, and risk frameworks), compiled into a form a runtime can evaluate. Nothing about your actual governance changes.
What happens if an agent's signing key is compromised?
Its certificate is rotated or revoked, which immediately cuts off its ability to sign new Intents, the same way disabling a compromised employee credential does. Rotation never invalidates historical decisions: what was evaluated under the previous key remains exactly as valid as it was.
Are Authorization Receipts available today?
Yes: every decision's receipt (actor, request, governing policy version, the human review resolution where one occurred, Capability Authorization state where one was issued or consumed, and cryptographic signature) is retrievable through the API and the Evidence Portal. What's still planned architecture, not yet shipped, is a fully portable, independently verifiable artifact that doesn't require access to PayReality's own systems at all. See Authorization Receipts for exactly what exists now versus what's direction.
What is Capability Authorization?
For an action that needs stronger execution control, PayReality can issue a short-lived, single-use authorization tied to the exact decision that permitted it: the agent, action, resource, environment, and runtime connection it was evaluated under. An external, customer-operated enforcement point verifies and consumes it before deciding whether to let the downstream operation proceed. At most one authorization can ever exist for a given decision, and once consumed it can't be replayed. It's issued only where a use case is configured to need it, not for every decision automatically.
What language is the SDK available in?
Python, today. Node.js, Go, Java, .NET, and Rust are on the roadmap, not yet started. See SDKs for the current state.
Does using PayReality mean we're compliant with [a specific regulation]?
No, and we wouldn't want you to read it that way. Runtime Authority operationalizes the governance your organization has already defined and produces evidence of how it was evaluated. That's useful input to a compliance program, not a substitute for your own legal or compliance sign-off, and not a claimed certification of any kind.
Who is PayReality for?
Enterprises deploying AI agents that take real-world actions (payments, procurement, contracts, ERP changes, infrastructure changes) where an unauthorized action has real consequences. See Solutions for how this applies across specific industries.
Does PayReality know if the action actually happened?
PayReality records what it authorized. Where a separately authenticated destination system or a trusted execution adapter supplies an execution receipt afterward, PayReality verifies that receipt's linkage to the original decision and reconciles the reported execution against the action that was actually authorized, resolving to one of six outcomes: MATCHED, MISMATCHED, EXECUTION_FAILED, PARTIAL, RECEIPT_MISSING, or INDETERMINATE. A cryptographically authenticated receipt proves what the trusted source reported. It does not independently prove that the underlying business system or real-world event was truthful.
Does AI-uploaded content become an active policy automatically?
No. AI can propose structured authority (roles, limits, approval chains) from governance documents you upload, but it cannot grant authority or activate a policy on its own. Citations and critical values are checked deterministically, human reviewers resolve identities and relationships, high-risk changes require a separate accountable actor to approve, and only an approved, versioned revision can be compiled and activated. This is validated so far only in controlled synthetic testing; accuracy against real enterprise documents is a separate evaluation, not yet complete.
If we revoke someone's delegated authority, does that automatically affect policies built from the Authority Graph?
Yes, for the delegation relationship a policy was actually compiled from. Authority Graph approvals are versioned snapshots, but a graph-derived policy stays grounded in the specific delegation it came from: that delegation has to still exist and be active at the moment of evaluation, not just at the moment it was reviewed. Revoking or letting it expire stops the policy from granting that authority automatically, with no manual policy edit needed.
Question not answered here?