Feature · Govern / Deny
Shipped · scope: GAP grant enforce-modeAuthorized before it runs.
Every action your gateway sees is checked against your grants before it is allowed to proceed. An action without a valid, unexpired grant is denied, not flagged after the fact.
What it does
Deny is the default, not an escalation.
Policies define what is allowed, for whom, and under what conditions. When a request does not match an active grant, SynOI blocks it before it reaches the system it targets, rather than letting it through and flagging it afterward.
Deny applies whether the caller is a human, a script, or an AI agent: the check is the same. AI agents are the sharpest edge of this problem today, but the checkpoint is not scoped to them alone.
How it works
Grants in, decisions out, automatically.
You define grants: who or what can take which action, under which conditions. Each call is evaluated against those grants at the moment it happens. The outcome, allow, deny, or route to a human, is recorded as a signed decision without any extra step on your part.
The core grant engine fails closed: an action without a valid grant is denied. Broader risk scoring on top of that (which model, which risk tier) runs in observe mode until you turn enforcement on, so adopting SynOI does not stop existing calls from working on day one.
Where this fits
Telemetry tells you what happened. This is what proves it was allowed.
Your operational intelligence tells you what happened. SynOI proves what was authorized before it ran, and lets anyone verify the record without trusting us.
Keep Honeywell, AWS, or your OI stack for telemetry. Add SynOI so each action it drives carries a signed, offline-verifiable authorization receipt an auditor can check without trusting the vendor.
Status
Shipped: the grant engine, policy packs, and CI/CD gating.
The capability grant engine, prebuilt policy packs, and CI/CD deploy-signing all run on this same checkpoint today. Multi-tenant isolation (separate policy sets per customer or team) is shipped and backs the Team tier.
Folded in from the former catalog
- Decisions
- Policy Packs
- CI/CD Governance
- Risk Policy Engine
- Capability registry (from the retired Conductor daemon)
- Multi-tenant isolation (MSP)
Set a grant, watch it deny what it should.
The gateway is free to start. Point your traffic at it and the deny-by-default check begins on the next request.