Authority Readiness Model
Find your authority maturity level
Most enterprises are at L1–L2. Humbleaf moves you to L4–L5 safely — one workflow at a time.
Self-locate on the ladder below, or take the self-assessment quiz. No thresholds, no internal mechanics — just the path from bearer-key automation to controlled autonomy.
The ascent · L0 → L6
Bearer-key automation
Standing keys, no per-action control — most exposed.
Logged actions
Recorded after the fact — reactive, not preventive.
Policy-checked actions
Some actions checked before running — basic control.
Evidence-backed decisions
Every decision leaves a replayable trail.
Identity continuity + risk awareness
Actors recognized over time; risk observed in shadow.
Approval-bound execution
High-risk actions need human approval bound to the exact action.
Optimized controlled autonomy
Policy tuned from evidence; approval burden optimized over time.
Self-assessment quiz
Five quick questions across credentials, evidence, identity, approvals, and scale. Your result reflects your weakest dimension — where authority maturity is most exposed.
Start in shadow. Gate when ready. Govern at scale.
The safe rollout path — observe before you enforce.
- MapIdentify one high-risk workflow and describe the authority surface — no credentials.
- ObserveRun in shadow: risk signals recorded, no enforcement until you are ready.
- GateTurn on human approval only after human-reviewed readiness.
- GovernExpand to adjacent workflows with evidence and oversight at each step.
The trust flywheel
Every protected workflow makes the next one cheaper to govern.
- Protected workflow
- Evidence bundle
- Risk pattern
- Policy tuning
- Fewer unnecessary approvals
- More workflows protected
Authority memory
Preserve the context behind consequential decisions: what was requested, which rules applied, what was approved or refused, and—where execution is connected—what happened.
Over time, this evidence can help operators identify recurring exceptions and review whether controls should stay, tighten, or change. Policy changes remain explicit and operator-approved.
Past decisions inform future reviews. They never substitute for current authorization.
Humbleaf is a new layer — not a relabel of tools you already have
Not IAM
IAM says who you are and what you can reach. Humbleaf authorizes the exact action at execution time.
Not SIEM / logging
Logs explain the past. Humbleaf controls the action before it runs and proves it after.
Not a generic approval tool
Approvals are bound to the exact action, used once, and expire — not a thumbs-up in chat.
Not an agent framework
Frameworks run agents. Humbleaf governs what they're allowed to do.
Not crypto-only
The authority layer is chain-agnostic. Onchain is one supported workflow type.
Not a compliance checklist
Checklists assert. Humbleaf enforces and evidences at runtime.
Not after-the-fact audit only
Control happens before execution, with evidence preserved after.
