For banks, payment processors, wallets, brokerages, exchanges, lenders and insurers
Control what an agent can do before it moves money or touches an account.
An agent can initiate a transfer, adjust a ledger entry, pay out a claim, change a policy or call a customer system in seconds. A log after the fact doesn't stop an unauthorized payment or an incorrect claims payout. The control point belongs before the action: which operation, which counterparty, what ceiling, whose approval, and for how long?
The gate
Explicit permission. Limited scope. Fail closed.
Route in-scope agent calls through The Membrane. Each call needs a live, signed, time-bounded scope naming the permitted model, tools and task. Out-of-scope calls are blocked. Expired authorization or broken continuity stops the next call. Each action leaves a tamper-evident, hash-linked receipt.
Spend authorization: a worked example
Permission to call a payment service is not permission to spend.
An agent that can reach a payment rail needs its own limits. The gate's spend boundary binds the caller and task to an allowed payee, a per-call ceiling and a cumulative budget. The ceiling is reserved against the budget before anything is dispatched, and the final cost is recorded after settlement.
Reserve before dispatch.
Budget accounting is durable and atomic across concurrent calls. A request that does not fit the remaining budget is denied before any money moves. Dispatch happens once, bound to the reservation with an idempotency identifier.
Uncertain is held, not retried.
A timeout is not proof that nothing was paid. If a dispatch may have spent funds but confirmation is missing, the reservation stays held for operator reconciliation. It is never released or retried automatically.
Keep the evidence with the action.
Receipts record the rail, payee, reserved ceiling, final cost and settlement reference, chained to the signed scope that authorized the call. Bearer tokens and signing keys never appear in receipts or in model-visible context.
Implementation status: the spend budget ledger and two settlement adapters (Routstr and Crossmint) exist with mock-rail tests. They have not been run against live payment rails, and funding and refund flows are not built. The gate, ledger and receipt chain are the existing foundation; the design is documented in docs/settlement-adapters.md.
Your systems. Your control.
Authorize before execution. Keep evidence your auditors can verify.
An inline control point.
Monitoring flags an unauthorized payment or a wrong claims payout after it settles. The Membrane controls routed agent actions before they execute: a transfer, a policy change, a customer-account action. Deterministic, human-written policy makes the decision; no AI sits in the authorization path.
Self-hosted, operator-owned.
Run the gate in your environment and hold your own signing keys, including air-gapped deployment. Spend limits and payee allowlists live in operator policy, outside model-visible context.
Tamper-evident receipts, ready for your SOC.
Hash-linked receipts tie actions to their authorization. Export JSON Lines or OCSF-inspired JSON to your SIEM, so review and compliance teams work from your records, not only a model provider's logs.
Try the authorization layer
Grant. Allow. Block. Sever. Inspect.
The public sandbox shows the gate logic: issue a scope, allow an approved action, block an unauthorized model or tool, and stop an agent when authorization expires or is severed. Inspect the linked receipts and export the evidence.
The sandbox uses simulated Jira, Slack and GitHub tool effects, ephemeral keys and an in-memory bus. It does not move money or hold production credentials. It demonstrates the control layer that a financial workflow would use.
Run it locally
No secrets. No paid APIs.
Run the same interactive gate walkthrough on your machine. Gate checks and receipt chaining, with simulated tool effects.
git clone https://github.com/membrane-hq/the-membrane.git
cd the-membrane
cargo run -p membrane-cli --features demo -- demoThen open http://127.0.0.1:8790/