TrustRelay
TrustRelay sits at the merge boundary and independently authorizes every agent-authored change before it merges.
Observe
A pull request authored by an agent is detected at the merge boundary.
Assemble evidence
Attribution, human sponsorship, policy context, and check results are gathered into a versioned evidence snapshot.
Decide
Deterministic policy is applied to the evidence to issue approve, block, or escalate. No AI makes or modifies the decision.
Sign the record
The decision is written as a signed, independently verifiable Agent Change Passport.
Enforce
The signed decision is published as a required check that governs whether the change may merge.
TrustRelay surfaces as a required check on the pull request, a signed decision record that outlives it, and a command that puts the flow in place. These are the real artefacts, not mockups of a future release.
TrustRelay authorization
Agent-authored change without a human sponsor recorded.
To proceed: Assign a sponsor, then re-run the check.
Agent Change Passport
kms:9f3c…c41aKMS-signed and independently verifiable without TrustRelay API access.npx @trust-relay/trctl init --repo acme/apiNo pilot has run yet, so there are no customer metrics to report and we will not invent any. What is verifiable today is the engineering: each figure below was counted from the codebase, and the file that establishes it is named under the number.
Basis Decision engine source — decision-engine/src/engine/decision-engine.ts
Basis Reason-code registry — decision-engine/src/engine/reason-codes.ts
Basis Replay suite — decision-engine/tests/e2e/replay.test.ts
Basis Domain types — domain-types/src/entities/policy.ts
Reserved for design-partner logos — none are published yet
When an agent contributes to a pull request, the merge decision depends on five questions that most engineering organizations cannot answer with confidence.
Was it a human, an agent, or a mix? Current tools cannot reliably distinguish agent-authored from human-authored code across multiple coding agents.
Is there a designated sponsor? Without a binding between the agent's work and an accountable human, there is no one to answer for the change.
Has it passed the required checks, reviews, and compliance gates? Evidence is scattered across CI/CD, security scanners, and manual review — none of it connected to the authorization decision.
Was the same policy applied consistently? Without a versioned policy binding, the same change can be evaluated differently depending on when and how it is reviewed.
Did it succeed, fail, or get reverted? A merge decision disconnected from the production outcome cannot be learned from.
TrustRelay authorization
No human sponsor recorded for this agent-authored change. The required check cannot pass.
To proceed: Assign a sponsor, then re-run the check.
Every agent-authored change follows the same five-stage path, from the moment it is observed to the moment it is enforced. The decision is deterministic at every stage.
A pull request authored by an agent is detected at the merge boundary.
Attribution, human sponsorship, policy context, and check results are gathered into a versioned evidence snapshot.
Deterministic policy is applied to the evidence to issue approve, block, or escalate. No AI makes or modifies the decision.
The decision is written as a signed, independently verifiable Agent Change Passport.
The signed decision is published as a required check that governs whether the change may merge.
Six properties of the authorization layer. Each one exists so that a decision can be reproduced, explained, and enforced.
A pure function with zero runtime dependencies on network, database, or model SDKs. Given the same evidence and policy, the result is always the same.
A KMS-signed, versioned artefact capturing policy version, evidence snapshot, attribution assertions, and outcome.
Every passport is stored with WORM protection. Evidence cannot be altered after the fact.
If the check fails, branch protection prevents merge. Enforcement is architectural, not procedural.
BLOCK > ESCALATE > APPROVE. If any rule blocks, the decision is BLOCK regardless of the others.
AI may propose typed assertions. Invalid or conflicting ones become UNKNOWN and can never produce automatic approval.
TrustRelay is a polyrepo distributed system on AWS. Each service is independently deployable with its own CI/CD pipeline, and the decision engine has no runtime dependency on the network, a database, or a model SDK.
Detect the change
Assemble the inputs
Decide deterministically
Sign and retain
Govern the merge
Every integration is either an evidence source that strengthens the decision or an enforcement point that carries it out.
Enforcement point
Required checks, rulesets, and branch protection at the merge boundary. This is where a decision is carried out.
Evidence source
Agent session metadata, attribution signals, and code provenance.
Evidence source
Work-item context and assignee records that bind a change to its intent.
Evidence source
Check results and pipeline status, gathered into the evidence snapshot.
No AI makes or modifies an authorization decision.
The decision is made by a deterministic engine that has no runtime dependency on a network, a database, or a model SDK. AI may propose typed assertions; it never makes or modifies the decision, and an architecture test fails the build if a model dependency is introduced into the engine.
Verifying a decision record proves the bytes are unaltered and were signed by the key you supplied. It does not prove the evidence was complete, that the policy was right, or that the decision was the correct one.
When every commit has unknown attribution, the engine escalates to human review rather than approving. The product cannot always establish which agent produced a change, and it does not pretend to.
In shadow mode the check never reports success or failure — it is neutral or action-required — and merge eligibility is unaffected. Enforcement begins only when you enable it.
TrustRelay evaluates evidence against the policy you pin to a repository. It does not decide whether that policy is appropriate, and a wrong policy applied consistently is wrong at scale.
Start in shadow mode and see the decision TrustRelay would have issued for your last hundred agent-authored changes.