THE MEMBRANE OPERATOR AUDIT
Synthetic demo / no live data← Home

OBSERVE. DON'T OVERRIDE.

Every boundary, visible.

Authorization decisions and the policy behind them. No controls, no write access.

UNKNOWN

Waiting for a verified snapshot

THE AUTHORIZATION BOUNDARY

One gate. Every attempted crossing.

Illustrative paths from the same three synthetic decisions below. Not a network inventory.

1 sample identity1 allowed crossing2 stopped at the gateLIVE STATE UNKNOWN
Synthetic authorization boundary mapOne sample identity makes three attempts. A chat attempt passes all authorization checks. A tool attempt is denied by the tool allowlist. Another chat attempt is denied by the IAC signature check. Denied paths stop at the membrane. Destinations are illustrative action categories, not verified services. REQUESTING IDENTITYMEMBRANEACTION BOUNDARIES AUTHORIZATION GATE Sample agentsynthetic-gate-identity3 fixture attempts ALLOW · checks passedChat channel DENY · tool allowlistTool boundary DENY · IAC signatureChat channel Dashed paths = not reached
Sample paths through the membraneThree synthetic attempts from one sample identity. Only the allowed chat path crosses the membrane. The tool and second chat paths are denied at the gate. Sample agent3 fixture attempts MEMBRANE · AUTHORIZATION GATE ALLOWDENYDENY ChatToolChat CrossedNot reachedNot reached

Animated from three invented decisions, looping. It does not run an agent or send a request.

Gate liveness

Unknown

No checkpoint data

Decisions retained

-

3 synthetic sample decisions

Deny rate

-

Over retained decisions

Observed since start

-

Invented preview, not real traffic

Decision log

Newest first. Rule codes, not request bodies.

Time (local)DecisionRule matchedActionGate identity / scope
No verified decisions yet.

Loaded policy

Registry loaded by the running gate. Configuration stays in files.

VIEW ONLY
Source
Waiting for gate

The registry is one authorization layer. Signed per-request IAC scopes can restrict it further; this is not a view of every agent's effective permissions.