Approval required
Pause the campaign feeding the impaired funnel
Cost per trial rose 212% over six days while conversion held flat.
Autonomous Company Operating System
Give your company a goal.
Watch the work get done. And verified.
Orvay proposes what your company should do next, asks before anything leaves the boundary, and proves what happened afterwards. An agent saying “done” is not proof that anything was done.
Eight gates, in a fixed order. The order is a security property, not a style choice.
- scopePassedscoped to Northwind
- haltPassedno halt engaged
- consentPassedno directed communication
- policyNeeds approvalads.campaign:pause is approval-gated
- budgetPassedwithin the included allowance
Verified by a different actor than the one that executed. That is the first law, and it is checked rather than asserted.
Simulated: no external system was contacted
9f2c41ab7d0e…Every window above is the real component, rendered by this page. Nothing here is a screenshot.
This is the product, not a picture of it
The decision below was computed by the same policy engine the server runs. Approve it and you will write to a real hash-chained record, then verify that record yourself.
An agent is asking
CRITCritical riskEmail the 1,840 trials that hit the broken checkout
- Cannot be undone
- 1 of 1 steps
- Reaches
- 1,840 people
- Contract
- Sealed
4edbf9d34953…
The reasoning cites support-ticket#4412: text an outsider controls. Risk was raised and automatic approval withdrawn.
Why it is asking you
- authenticatePassedagent a_growth
- scopePassedscoped to co_northwind
- haltPassedno halt engaged
- entitlementPassedteam plan
- authorizationPassedgranted by role or agent policy
- consentPassedno directed communication
- policyNeeds approvalemail:send:company is restricted, elevated to approval because the rationale cites untrusted input (support-ticket#4412)
- budgetPassedno spend
The policy engine, the risk derivation and the hash chain above are the product’s real code, running here. Only the world beyond them is simulated. Nothing was contacted.
Simulated: no external system was contacted
Governance is the product, not a settings page
Nothing proceeds without a decision
Eight gates in a fixed order: authentication, tenant scope, halt, plan, role, consent, policy, budget. A human clicking approve and an agent calling a tool traverse the same ones.
Some things are never permitted
A forbidden capability cannot be released by a role, a plan tier, or an emergency. Not a stronger warning. A different answer.
The proposer never verifies
Work is checked by an actor that did not perform it, against machine-evaluable expectations: an exit code, an HTTP status, a database read.
Nobody is contacted without a basis
Consent is a record, not a checkbox: who, on what basis, in which words, and whether it was withdrawn. An action that reaches a person without one is refused before any adapter is reached.
Two ways in, one operating system
Connect what you already run
GitHub, Stripe, analytics, support. Each connection states the authority it grants before you grant it, and every capability starts gated.
Or start from a sentence
Describe what you want to build and get an operating structure: the stages, the questions that must be answered, and how much authority each part should start with.
What this is not, yet
Orvay is a working proof of concept. Every external effect is simulated: nothing here connects to a real account, moves money, or sends a message. The governance engine, the audit chain and the cost metering are real and are what we are asking you to judge.