Independent Authorization at the Merge Boundary
TrustRelay connects to your existing GitHub workflow, learns your policy, and independently authorizes every agent-authored change before it merges.
Key Features
Built for the merge boundary
Every feature is designed around a single principle: safe, auditable, and deterministic authorization at the point where code enters production.
Deterministic Policy Engine
A pure function with zero runtime dependencies on network, database, or model SDKs. Every decision is reproducible and testable.
Agent Change Passport
A KMS-signed, versioned artifact that captures the complete decision context: policy version, evidence snapshot, attribution assertions, and outcome.
Immutable Evidence Ledger
Every passport is stored in an S3 ledger with WORM (Write Once Read Many) protection. Evidence cannot be altered after the fact.
GitHub Required Check
TrustRelay publishes a required status check on every PR. If the check fails, branch protection prevents merge — enforcement is architectural.
Restrictive Precedence
BLOCK > ESCALATE > APPROVE. If any policy rule blocks, the decision is BLOCK regardless of other rules. Safety is the default.
Bounded AI Assertions
AI may propose typed assertions with source qualification and confidence scores. Invalid or conflicting assertions become UNKNOWN and cannot produce automatic approval.
Architecture
Designed for security and auditability
TrustRelay is a polyrepo distributed system on AWS. Each service is independently deployable with its own CI/CD pipeline.
Trigger Layer
GitHub webhooks, poll-based PR detection
Evidence Pipeline
Attribution analysis, CI artifact collection, repository metadata
Decision Engine
Deterministic policy evaluation, typed assertions, reason codes
Passport Service
KMS signing, S3 ledger, WORM protection
Enforcement
GitHub required check, status reporting, override handling
Integrations
Works where your team works
TrustRelay connects to your existing toolchain as evidence sources and enforcement points. Each integration strengthens the authorization decision.
GitHub
Enforcement point — required checks, rulesets, and branch protection at the merge boundary
GitHub Copilot
Evidence source — agent session metadata, attribution signals, and code provenance
Cursor
Evidence source — AI Code Tracking API signals for agent-authored change detection
Slack
Enforcement point — escalation notifications and override channel
Ready to safely delegate merge authority?
TrustRelay is the independent authorization layer that lets enterprises reduce manual review of low-risk, agent-authored changes.