- You send a workflow or API description
- We map the consequential actions
- You receive a risk-prioritized authority map
- Pick a first workflow to guard in shadow mode
The fastest first step
Map your authority surface — no credentials required
Send a workflow or API description. We return a risk-prioritized map of consequential actions, control routes, and where approval or receipt coverage may be weak — an analysis artifact, not an integration.
Get your Authority Surface Map
What you receive
- Consequential action inventory (risk-prioritized)
- Allow / deny / approval route map
- Where approval or receipt coverage may be weak
- First recommended shadow-mode guard
- Pilot path if the workflow is a fit
What an authority surface includes
Every organization has an authority surface — the shape of who and what can act across your stack. Read the topology note.
Actors & surfaces
- Humans and operators
- Agents and automations
- Wallets and payment rails
- Repos and deployment paths
- APIs and integrations
- Policies and approvals
High-risk transitions
- Propose actions
- Approve or deny
- Execute and deploy
- Sign and move value
- Modify config or credentials
Risk weights
- Value that can move
- Blast radius if wrong
- Reversibility
- Policy coverage
- Receipt coverage
What Humbleaf can map
Any surface where automation can take a consequential action.
Money movement
Refunds, payouts, settlement, spend approval.
API and SaaS actions
Privileged calls into customer and business systems.
Code and deployment workflows
Commits, releases, workflow dispatch.
Infrastructure operations
Config changes, secret rotation, privileged automation.
Data release and compliance events
Exports, disclosures, regulated triggers.
Agent delegation
One agent granting authority to another.
Spend and procurement
Purchase commitments and vendor actions.
Sample map
Illustrative buyer-safe projection — consequential actions ranked by risk surface, not a production readiness claim.
Projection only — not a production readiness claim. Canonical truth remains internal catalog + evidence pipeline. Generated 6/21/2026 · visibility partner_safe · Route #3 selection proof_lab.publish.guard.v1
| Action | Risk | Route | Reversibility | Blast radius | Policy hint |
|---|---|---|---|---|---|
website.shipped_log.update public_claim · capability_status | HIGH | website.shipped_log.update.v1 | reversible | module | ALLOW · dual-control recommended |
website.claim.publish public_claim · investor_surface | MEDIUM | website.claim_publish.guard.v1 | reversible | production | APPROVAL_REQUIRED |
capability.status_change capability_status · public_claim | MEDIUM | capability.status_change.guard.v1 | reversible | module | APPROVAL_REQUIRED |
repo.branch_push source_code_change · release_surface | HIGH | ops.repo.dev_push.guard.v1 | reversible | module | APPROVAL_REQUIRED · dual-control recommended |
repo.workflow_dispatch money_movement · refund | HIGH | repo.workflow_dispatch.af3b5501f65b | hard | production | APPROVAL_REQUIRED · dual-control recommended |
repo.workflow_dispatch settlement · money_movement | HIGH | repo.workflow_dispatch.0495f6dafb5f | hard | production | APPROVAL_REQUIRED · dual-control recommended |
webhook.endpoint.update credential_surface · exfiltration | HIGH | integration.webhook_mutation.guard.v1 | hard | service | APPROVAL_REQUIRED · dual-control recommended |
repo.branch_push ci_execution · release_surface | CRITICAL | ops.repo.workflow.surface_profiler_self_profile_gate_yml | hard | service | ALLOW · dual-control recommended |
Choose your first protected workflow
Start with one. Observe in shadow. Gate when ready.
01
Payment or refund workflow
Guard money movement against anomalous value before it settles.
02
Admin / config mutation
Require authorization for production-touching configuration changes.
03
Workflow dispatch or deployment
Govern privileged automation per action, not per standing token.
04
API key / webhook mutation
Block unauthorized integration tampering before it takes effect.
05
Onchain transaction guard
Authorize high-value onchain actions with signed receipts where supported.
06
Agent delegation guard
Bound, provable delegation chains instead of authority sprawl.
The right control for the right action
Not every action needs the same boundary. The map assigns each one the right control.
01
Deterministic checks
For actions that can be simulated or replayed.
Where an action's correctness can be verified directly, the strongest boundary is deterministic verification.
02
Evidence-bound receipts
For API, DevOps, and business workflow actions.
Where the goal is accountable evidence, each action produces a replayable record bound to its decision.
03
Human-gated authorization
For high-impact, ambiguous, or irreversible actions.
Where stakes are highest, a named human approves the exact action before it executes.
