Delegate Merge Authority Safely
TrustRelay sits at the merge boundary and independently authorizes every agent-authored change before it merges.
The Five Questions
No One Can Answer at Merge Time
When an AI coding agent contributes to a pull request, the merge decision depends on five questions that most engineering organizations cannot answer with confidence.
Who or what produced this change?
Was it a human, an agent, or a mix? Current tools cannot reliably distinguish agent-authored from human-authored code across multiple coding agents.
Which human authorized this work?
Is there a designated sponsor? Without a binding between the agent's work and an accountable human, there is no one to answer for the change.
What evidence exists that this is safe?
Has it passed the required checks, reviews, and compliance gates? Evidence is scattered across CI/CD, security scanners, and manual review — none of which are connected to the authorization decision.
Which policy governed this decision?
Was the same policy applied consistently? Without a versioned policy binding, the same change can be evaluated differently depending on when and how it is reviewed.
What happened after this change was released?
Did it succeed, fail, or get reverted? The merge decision is disconnected from the production outcome, making it impossible to learn from past decisions.
The Solution
Independent authorization that earns trust
TrustRelay is a deterministic authorization layer that observes every agent-authored pull request, assembles a verifiable evidence snapshot, and applies your policy before anything merges.
Independent Authorization
TrustRelay is a neutral authorization layer that sits between coding agents and the merge button. It is not a coding agent, a source-code host, or a CI/CD platform.
Deterministic Decisions
Every decision is made by a pure deterministic engine. Given the same evidence and policy, the result is always the same. No AI makes or modifies authorization decisions.
Signed Evidence
Every decision is KMS-signed and stored in an immutable ledger. The resulting Agent Change Passport can be independently verified by any party without TrustRelay API access.
Required Enforcement
TrustRelay publishes a required GitHub check. If the check fails, the PR cannot merge. The customer controls the override path, and the original decision is never rewritten.
How It Works
From pull request to decision in four steps
TrustRelay integrates at the merge boundary, providing independent authorization without disrupting developer workflows.
Observe
TrustRelay monitors GitHub pull requests where AI coding agents have contributed code changes.
Analyze
Attribution and evidence. TrustRelay identifies which coding agent contributed to the change, binds the work to a human sponsor, and assembles a versioned evidence snapshot from GitHub, Jira, and CI/CD pipelines.
Decide
Deterministic policy. Your policy is applied to the evidence snapshot. The result is APPROVE, BLOCK, or ESCALATE — each with a stable reason code and a complete explanation.
Enforce
Enforce and record. A signed Agent Change Passport is issued to the immutable ledger. A GitHub required check reports the outcome. Overrides and production outcomes are preserved without rewriting history.
Ready to safely delegate merge authority?
TrustRelay is the independent authorization layer that lets enterprises reduce manual review of low-risk, agent-authored changes.