AI already acts on its own.Decide what it's allowed to do.
AI and automated systems can now take real actions on their own: move money, change records, trigger workflows, call other systems. RAC decides whether each action is allowed to happen, the instant before it happens.
Most enterprises have no control layer in the path to verify that a machine-initiated action was authorized before it executes, and before downstream state changes. Runtime Authority Control is that layer.
The Weekend: A RAC Cost Horror Story
50 seconds. What one unattended agent does to a budget between Friday night and Monday morning.
You went home. Your agent kept working.
One autonomous agent, left running over the weekend to reconcile vendor payments. No human in the loop. Here is the timeline your detection tool reconstructed, on Monday.
FRI
MON
Guardrails suggest.
RAC decides.
Detection watches. Authorization acts. The difference is whether the damage is a report, or something that never happened.
- ×Runs after the action has executed
- ×Produces alerts and reports, not outcomes
- ×By the time it fires, the damage is done
- ✓Runs before the action executes
- ✓Returns a verdict: ALLOW / CONSTRAIN / BLOCK
- ✓The damage never happens in the first place
This time, the payment never leaves.
Every action the agent attempts is routed through one authorization checkpoint. Two of them never make it past the boundary.
Three outcomes. Nothing in between.
Compliant operations execute with no added latency. Authority is granted, not assumed.
Risky operations are trimmed to policy limits: capped, scoped, or held for approval, then allowed to proceed.
Outright violations are refused before they run. Nothing executes, nothing to clean up.
Autonomy with a hand on the switch.
RAC sits between your AI and everything it can touch, so agents move fast, and policy still decides what they're allowed to do.
Every decision, on the record.
Stop detecting.Start authorizing.
Put a runtime authorization checkpoint in front of every AI-initiated action, before the next Friday night.
This is what RAC does, on every machine-initiated action.
Each row is an action a system tried to take on its own. RAC evaluates the authority behind it in context and returns one outcome, before anything downstream changes.
Illustrative decision flow. Action types, targets, and policy outcomes shown are representative of governed enterprise execution.
A runtime authority control plane for machine-initiated execution.
RAC operates between software-originated intent and enterprise execution, validating whether an action is authorized before downstream systems process it. It is built for environments where automation, orchestration, copilots, agents, workflows, or AI-enabled systems can initiate operational action.
- A runtime control layer in the enforcement path, not outside it
- A machine-initiated action authorization system
- A deterministic enforcement control plane
- A source of decision-grade governance artifacts
- Not IAM: identity and access is not execution authority
- Not model governance: models are not the execution surface
- Not observability: seeing is not governing
- Not a dashboard that reports what already happened
RAC governs execution authority itself, at the point where execution authority must actually be decided.
The gap is not visibility.
The gap is runtime authority.
Most enterprises already have the pieces: identity management, workflow controls, audit trails, observability, policy frameworks. These systems are well-built for the problems they were designed to solve. What they cannot provide is runtime authority control.
- →Who has access
- →What rules and policies exist
- →What happened after the fact
- →Whether credentials were technically valid
- →What the model or system produced
×Whether a machine-initiated action should be allowed to execute right now, under these conditions, against this target, with this level of authority, before the action occurs.
“Policy without runtime enforcement is not authority. It is aspiration.”
The RAC Ecosystem
Four coordinated layers for governing machine-initiated action: diagnosis, decision, transformation, and verification.
Measure exposure to ungoverned machine action.
Seven-question diagnostic that quantifies an organization's runtime authority gap. The first step before remediation.
Runtime authority control plane.
Determines whether a machine-initiated action is authorized to execute, at runtime, in context, before downstream state changes. The control plane.
Governed creative execution.
Brand-governed content transformation under runtime authority. Provenance enforcement, not style approximation.
Governance verification infrastructure.
Continuously preserves decision-linked evidence and produces proof that machine action remained within policy, across time, on demand, for regulators and auditors.
TORIXA diagnoses. Runtime Authority Control™ decides. RIMAGINC transforms. CORTHEM verifies. One coordinated architecture for runtime governance.
CORTHEM is additive to RAC, never a dependency. RAC stands on its own as the runtime authority control plane.
Runtime Authority Control originates from the Hartstone Institute, the research, category creation, and venture development umbrella founded by Emily Hartstone.
Govern executionbefore systems act.
Enterprise briefings for security leaders, compliance teams, and operators running environments where machine-initiated execution is already a reality. Tell us where you are, and we'll bring the briefing to the right level.
Commercial commitment. Direct access to the RAC team. Priority onboarding. Input into roadmap. Pricing: inquire.
Become a Founding MemberApply on the secure formFree exploration tier for operators validating runtime authority in their environment. Console access. Community support.
Join Early AccessApply on the secure formSubmissions go directly to Runtime Authority Control. We respond to qualified enterprise inquiries within two business days.
Already exploring the console? Sign in · Want a reference walkthrough? See the reference demo