ARCHITECTURE
How Stipul authorizes AI agent tool calls at runtime
Stipul is a runtime authorization and audit layer for AI agent tool calls. For mediated tool calls, Stipul sits between agents and external APIs, creating a deterministic control point before execution. Charter defines the policy, Writ enforces it, Chronicle records each mediated enforcement decision, and Seal verifies whether the evidence remains intact.
RUNTIME CONTROL CHAIN
Charter to Seal
The Stipul architecture is built around four components: Charter, Writ, Chronicle, and Seal. Together they define policy, enforce runtime authorization, record tamper-evident audit evidence, and verify integrity after the session.
Charter
Policy engine
Defines allowed tools, denied tools, constraints, approval rules, and workflow boundaries.
Writ
Enforcement proxy
Receives mediated tool calls, evaluates them against the Charter, and allows or denies before execution.
Chronicle
Evidence store
Records mediated enforcement decisions as structured, tamper-evident evidence.
Seal
Cryptographic attestation
Binds the session, Charter fingerprint, and Chronicle hash into a verifiable receipt.
TOOL-CALL LIFECYCLE
What happens when an agent makes a mediated tool call
01
Request
The agent requests a mediated tool call — a structured API action routed through Stipul. The request arrives at Writ.
02
Load Charter
Writ loads the Charter in force for the session. The Charter declares which tools are allowed, which are denied, and which require elevated approval.
03
Evaluate
Writ evaluates the request against the Charter. This is deterministic. The same request under the same Charter produces the same decision every time.
04
ALLOW
If allowed
Writ forwards the call to the third-party API. The response returns through Writ to the agent. Chronicle records the decision.
05
DENY
If denied
Writ does not forward the mediated call. Nothing is sent to the third party through the Writ enforcement path. Chronicle records the decision and the rule that triggered the denial.
06
Seal attestation
When the session closes, Seal binds the Chronicle to a cryptographic attestation. The full decision chain is now tamper-evident.
TECHNICAL MODEL
Technical model
CHARTER
Charter — AI agent policy as a declarative artifact
The Charter is a YAML file that declares which mediated agent actions are allowed, denied, constrained, or approval-gated. Allowed tools, denied tools, risk classifications, call limits, egress restrictions, and approval requirements. One file readable by security, platform, compliance, and legal.
The Charter is not instructions to the agent. The agent does not need to see or follow the Charter. Writ reads it and enforces it outside the agent's discretion. The agent's intent is irrelevant to the enforcement outcome.
A Charter can be scoped to a session, workflow, or governed integration. It can be versioned, reviewed, and diffed like any infrastructure config.
WRIT
Writ — deterministic enforcement for AI agent tool calls
Writ is a runtime enforcement proxy that sits between the agent and governed external API calls. Every tool call mediated by Stipul routes through Writ. No mediated call reaches a third party without Writ evaluating it against the Charter first.
Writ is designed to fail closed for unknown, malformed, or unauthorized mediated tool calls. If the Charter cannot be loaded, the call is denied. If evaluation fails, the call is denied. If the tool is not explicitly listed in the Charter, the call is denied. The default is no. This contrasts with agent workflows where accessible tools may be callable by default unless a separate enforcement layer constrains them.
Writ does not interpret, negotiate, or reason about intent. It evaluates the request against the Charter and produces a deterministic allow or deny.
CHRONICLE
Chronicle — tamper-evident audit records for AI agent decisions
Chronicle records every mediated enforcement decision as a structured event the moment it happens. What tool was requested, what Charter rule applied, what the decision was, and when it occurred.
Events are hash-chained. Each event references the hash of the previous event. Modifying, inserting, or removing any event in the chain breaks the hash sequence.
Chronicle is an evidence chain, not a general-purpose logging system. Events are written as structured enforcement evidence and chained so tampering can be detected during verification.
SEAL
Seal — cryptographic proof of AI agent session integrity
When a session closes, Seal binds the Chronicle to a cryptographic attestation. The attestation covers the full chain of events from session open to session close.
Verification checks two things: that the Seal is valid and that the Chronicle is intact.
If one byte in the Chronicle changes after the Seal is created, verification fails. This is not a warning. It is a binary outcome: VERIFIED or REJECTED.
Fail-closed behavior
Writ is designed to fail closed for governed mediated calls.
Chronicle write failure terminates the session; the call is not treated as successfully authorized. If the evidence cannot be recorded, the action cannot proceed.
Trust boundaries — what Stipul controls and what it does not
TRUSTS
The Charter is correct as written. Stipul enforces the Charter; it does not validate whether the policy makes business sense.
DOES NOT TRUST
The agent.
The agent's stated intent.
The model's compliance with instructions.
Network availability.
Third-party API behavior after a forwarded call.
CANNOT PROTECT AGAINST
Direct API access that bypasses Writ.
Leaked credentials used outside the governed workflow.
A compromised host running the Writ process.
Actions taken through channels Stipul does not mediate.