The last gate before an AI-proposed action becomes an external effect. An AI assistant may prepare a $250,000 wire — it has no authority to execute one. Gamma answers one question, deterministically and replayably: should this AI-proposed action be permitted to execute? PERMIT or SAFE_STATE. Nothing else.
Fraud detectionAML screeningCompliance enginePolicy managementAn AI judgeA semantic-truth engine
The problem
AI is starting to do things, not just say things.
Assistants now move money, send emails, place orders and control systems. The moment a proposal becomes an external effect, it is irreversible — and today almost nothing answers the authority question consistently or leaves proof behind.
AI proposescapability, not authority
Who says yes?the externalization boundary
External effectirreversible in the world
The missing checkpoint is not another review layer — it is an externalization boundary: the one place where capability must be converted into authority, or refused. Gamma is that boundary.
Positioning
An execution-authority boundary — and only that.
What Gamma is
The runtime authorization boundary, immediately before execution.
Deterministic — the same sealed evidence, policy epoch and method version always yield the same decision.
Replayable — every decision, including every denial, is sealed and re-verifiable.
An evaluator of the approved predicate manifest — it consumes controls and signals, it does not author policy.
What Gamma is not
Not fraud detection, AML screening or a compliance department.
Not policy management — it evaluates the manifest others approve and sign.
Not a risk-prediction model, an AI judge or a semantic-truth engine.
Not a replacement for your risk stack — those systems define the required controls and produce the authoritative signals.
The operating model
End-to-end AI governance, in three planes.
Governance decides what is required. Gamma decides whether execution is allowed. Operations keeps both honest over time. Gamma occupies exactly one of these planes — and nothing else.
Governance plane
What is required
Business · Risk · Legal · Compliance define the obligations.
Output → Signed Predicate Manifest + Enforcement Profile
Runtime authorization plane
Whether execution is allowed
Gamma — the execution-authority boundary, and the only plane it occupies.
Audit · SecOps · Policy lifecycle keep both honest.
Output → Continuous governance
A risk class is not a label. Tier 4 / CRITICAL compiles into concrete enforcement: complete mediation, a short permit TTL, dual authorization, class-level veto, commit-before-actuate, enhanced retention and no degraded execution path for high-consequence wire transfers.
Business objectives→Risk classification→Policies→Controls→Signed predicate manifest→Gamma authorization→Permit-to-Act→Evidence→Interlock→Execution→Replay→Continuous governance
Before anything is decided
First, Gamma fixes exactly what is being authorized.
A natural-language request is not an authorizable object. Gamma converts the raw AI proposal into a canonical Action Envelope and a typed Context Translation Record — pinned to a policy epoch, a runtime epoch and a freshness window.
action_idACT-WIRE-20260723-001
action_classWIRE_TRANSFER
principalU-8821
accountACC-4471-BUS
beneficiaryBEN-SUPPLIER-B
amount250000.00 USD
corridorUS→DE
policy_epochPOL-EPOCH-774
runtime_epochRT-EPOCH-229
ttl5 seconds
context_hashctr@1148…
Schema completeMandatory fields presentEvidence resolvableContext freshUncertainty boundedAction class recognized
Gamma never guesses around incomplete or stale context. Insufficient context is itself a deficit and forces SAFE_STATE — reason code CONTEXT_INSUFFICIENT.
How it decides
Many yes/no checks. Two deficit aggregates. One strict rule.
Each required control becomes one yes/no runtime predicate. Action-level deficits aggregate into Γ_G; persistent class-level deficits aggregate into Γ_class. Try it — click any predicate to flip it.
👈 Click a predicate to toggle pass / fail
Action level — Γ_G
Class level — Γ_class
Γ_G
0
Γ_class
0
Π
1
PERMIT
Non-compensatory (the whole point). Γ_G = max(action deficits), Γ_class = max(class deficits). A pile of concurring predicates can never outweigh a single failure — so Gamma fails closed. In code: Π = 1 if Γ_G = 0 and Γ_class = 0 else 0.
The signed predicate manifest
Every predicate traces back to an owner and a policy.
Predicates are grouped by what they verify. Gamma does not author them — it evaluates the manifest that policy owners approved, signed and pinned to a policy epoch.
Anatomy of one predicate
Every entry in the manifest carries this metadata, and every decision records which epoch it was evaluated under.
PredicatePOL-AML-001
QuestionIs the destination sanctions-clear?
TokenSANCTIONS_CLEAR
Policy sourceAML Policy
EvidenceSanctions Screening Service
Freshness≤ 24 h
OwnerFinancial Crime Compliance
FailureSAFE_STATE
Policy epochPOL-EPOCH-774
A service returning a result is not authorization. “A fraud signal exists” says nothing about whether the signal is fresh, or whether the assessed risk is inside policy. One vague predicate becomes four precise ones:
FRAUD_SIGNAL_PRESENT
FRAUD_ASSESSMENT_AVAILABLE
FRAUD_SIGNAL_FRESH
FRAUD_RISK_WITHIN_POLICY_BOUND
NO_ACCOUNT_TAKEOVER_INDICATOR
Two levels of veto
One action can look clean while its action class is unsafe.
A specific transfer may satisfy every action-level predicate while the whole corridor is suspended, a fleet-wide revocation is in force, or the autonomy band has been narrowed. Those are class-level controls, and they veto independently.
WIRE_TRANSFER class activeUS→DE corridor not suspendedNo fleet-wide revocationCounterparty drift within boundAutonomy band within policyNo persistent class veto
Γ_G
Action-level maximum deficit. Any failing predicate about this action drives it to 1.
Γ_class
Persistent class-level maximum deficit. Any standing veto on the action class drives it to 1, regardless of how clean the individual action looks.
Π = 1 only when Γ_G = 0 and Γ_class = 0
Evidence & determinism
Evidence collected before decision. Decision proof committed before action.
These are two different objects at two different moments. Source evidence is bound before the decision, because it is the decision's input. The completed authorization proof — predicate results, Γ values, decision metadata, reason codes and permit metadata — can only exist after the decision, and is committed before any external action.
The four-part anchor that binds the record to a published method — not the evidence bundle itself.
Specification clause
L-DREA §6.4
Evaluation ID
GAMMA-DEMO-WIRE-001
Method version
GAMMA-G0-DEMO-2.0
Ledger hash
e34228f0…042534
TXN_000041 · PERMIT · 17a25225…
TXN_000042 · PERMIT · e34228f0…
TXN_000043 · SAFE_STATE · fe6be098…
Denials are committed too — and replay identically.
Authorization replay
Recomputes predicate values, Γ_G, Γ_class, Π, PERMIT/SAFE_STATE and reason codes from the sealed record — never from the current clock, the current policy or live external systems.
Execution verification
Confirms the Permit-to-Act was valid, unexpired, unrevoked and previously unconsumed; that the submitted action matched the authorized action hash; that the permit was atomically consumed; and that the executor returned a receipt. It does not re-run the payment network.
Same canonical evidence + same policy epoch + same method version → same authorization decision.
Authority horizon. Determinism warrants that the declared predicates and sealed evidence produce the same authorization result. It does not prove that the evidence is truthful, that the predicate set is complete, or that the action is semantically correct.
Execution authority
A PERMIT is an execution credential, not merely a label.
Gamma does not return a boolean and hope the caller respects it. A permitted decision is bound to one exact action and issued as a signed, scoped, short-lived, single-use, revocable credential.
token_idPTA-09fd-771a
action_hashe26c3039…
scopeWIRE_TRANSFER
principalU-8821
policy_epochPOL-EPOCH-774
runtime_epochRT-EPOCH-229
issued_at10:24:00.310
expires_at10:24:05.310
single_usetrue
revocabletrue
signatureEd25519 · sig@3ab9…
stateACTIVE
ISSUED→ACTIVE→CONSUMED•EXPIRED•REVOKED
What the credential guarantees
Bound to one exact action — a changed amount or beneficiary invalidates it.
Short-lived: a 5-second TTL, not an open-ended approval.
Cryptographically signed under the policy epoch key.
Single-use and atomically consumed — never replayable as authority.
Revocable fleet-wide, right up to the moment of use.
The interlock
A decision cannot bypass the execution interlock.
Authorization alone does not release an action. The actuation path opens only when three independent signals assert together — which is what makes Gamma an execution boundary rather than only a policy decision point.
Pphys = SIG_COMMIT ∧ SIG_GAMMA ∧ SIG_WATCHDOG
SIG_GAMMA
1 only when Γ_G = 0 and Γ_class = 0.
SIG_COMMIT
1 only when the completed authorization record is durably appended and the permit is valid.
SIG_WATCHDOG
1 only when no runtime liveness or infrastructure fault exists.
Released
SIG_GAMMA1
SIG_COMMIT1
SIG_WATCHDOG1
P_phys = 1 → action path released
Fail-closed — decision was PERMIT
DecisionPERMIT
Ledger writeFAILED
SIG_GAMMA1
SIG_COMMIT0
SIG_WATCHDOG1
P_phys = 0 → SAFE_STATE
A logical PERMIT is necessary but not sufficient for actuation. Scenario E in the live demo runs exactly this path.
Where the yes/no comes from
How each predicate's value is derived.
This is what reviewers ask first, so here it is honestly. A predicate's value is produced one of three ways, depending on the setting:
Path 1
Live from the environment
In the AI-agent tests, gates are computed on the spot from real state: is the recipient in the set of known recipients? · is the amount ≤ the account's limit? Thresholds and known-sets come from a signed policy manifest.
Real deployment path
Path 2
Calibrated from unlabeled data
In the blind test, the answer key is hidden and each threshold is set at the 99.9th percentile of ordinary traffic (“flag anything far outside normal”). Labels are opened only after every decision — the honest, leakage-free measurement.
Scientific measurement
Path 3 ⚠
Pre-set from a golden trace
In the large 284,807-row credit-card benchmark, gate values were written from the known outcome ahead of time. That makes it a conformance test — the engine faithfully reproduces the intended decision — not a demonstration that Gamma discovers fraud on its own.
Conformance, not detection
The evidence base
What each experiment proves.
The project isn't a claim — it's a reproducible package. One command regenerates every number, figure and table from executed code. A selection:
Honest results
What's proven, what's modest, what's not claimed.
Proven
The decision is deterministic and matches its spec exactly — checked exhaustively over all 2¹⁶ inputs.
Every decision, including every denial, is sealed and independently replayable.
A single failed mandatory predicate always stops execution (non-compensatory).
Measured, but modest
How well the same rule separates normal from abnormal on real, unlabeled data.
Strong on one dataset, only fair on others — reported as a spread, not averaged away.
Results are Tier-S (simulation / offline evaluation). Tier-H and Tier-T claims remain specification, not measurement.
Not claimed
That it replaces fraud / AML / compliance / policy management.
That the headline credit-card accuracy is “detection” (it's conformance).
That the evidence is truthful, the predicate set complete, or the action semantically correct.
That it scales horizontally today.
Blind detection — the honest measurement (E12)
Same frozen rule, answer key hidden until scoring. AUROC = separability (1.0 perfect, 0.5 = chance). The spread is the finding.
Nothing downstream may alter the original decision. That constraint is what makes results reproducible — and what makes the boundary meaningful.
①
Capability PlaneAI model, planner and tool invokers prepare a candidate action
②
Gamma Gatewayinterception, schema validation, Action Envelope and Context Translation Record
③
Predicate Planeidentity, account, beneficiary, policy, AML and risk adapters
④
Gamma Decision Corepredicate reduction, Γ_G, Γ_class and deterministic Π
⑤
Authority Servicesexecution binding, Permit-to-Act, epoch keys and revocation
⑥
Evidence ServicesERTuple, Evidence Quad, hash chain and replay
⑦
Enforcement SubstrateSIG_GAMMA, SIG_COMMIT, SIG_WATCHDOG and Pphys
⑧
External Executorbank payment gateway and settlement network
⑨
Governance Operationstelemetry, incidents, re-attestation and future policy epochs
See it decide
Watch Gamma authorize a $250,000 wire — live.
Six scenarios walk a real proposal through all 28 stages — use-case registration and manifest signing, then interception, canonicalization, predicates, the deterministic decision, permit issuance, proof commitment, the three-signal interlock, atomic consumption and replay, then monitoring, incident response and the next policy epoch — including the case where the decision is PERMIT but the action is still never released.