The action boundary for AI agents
Fulcrum decides whether a routed agent action may proceed before the tool executes.
For actions routed through Fulcrum, policy, budget, identity, and trust checks produce an allow, deny, or escalate decision before execution. Captured decisions become tamper-evident records whose integrity can be verified without Fulcrum credentials.
Can this agent do that?
This recorded Boundary v0.11.0 session denies the lethal-trifecta request before the upstream call, emits the decision record, and verifies that same record's integrity.
How it works
Fulcrum evaluates whether a routed action may proceed before execution and preserves the captured decision for review afterward.
Walk · 01 — Evidence
Fulcrum records the boundary decision outside the agent, before the tool executes. Hash-verifiable decision records let an independent verifier recompute record integrity without Fulcrum credentials.
| Rung | Status | Boundary |
|---|---|---|
| Signed receipts | BUILT | Signed at emission once FULCRUM_RECEIPT_SEED is set; signature attests the signer, not the verdict. Capture-scoped — not all governed traffic is captured. |
| Witnessed notary | BUILT | Deployed, independently verifiable, and Fulcrum-operated. |
| Independent authority | BET | Unmet. No organizationally independent witness operator exists today. |
Hash-verifiable local evidence artifact. Recomputed client-side (SHA-256 over the RFC 8785 / JCS canonical form) — record-scoped integrity, not authenticity. No hash chain.
Recorded Boundary conformance vector — a separate verification example from the recorded hero session, not live production evidence.
Walk · 02 — Modes
deterministic
LIVEclassified
LIVEproved
NAMED · SCOPED · EVIDENCED · NOT DEFAULThuman-approved
NAMED · SCOPED · EVIDENCED · NOT DEFAULTEvery decision carries a mode. Deterministic and classified run live today. Proved and human-approved are named, scoped, and evidenced, not yet the default path.
Walk · 03 — Deployment
| Route | Readiness | Boundary |
|---|---|---|
| MCP | PRODUCTION | Boundary's first and only production adapter route |
| Secure GitHub | PREVIEW | |
| Command Boundary | PREVIEW | |
| Edit Boundary | PREVIEW | |
| CLI | PREVIEW | |
| CodeExec | PREVIEW | |
| gRPC | PREVIEW | |
| Managed Agents | PREVIEW | |
| Webhook | PREVIEW | |
| A2A | PREVIEW |
CrewAI, AutoGen, and LangGraph are framework instrumentation. They instrument an orchestration boundary and are not equivalent to out-of-process transport enforcement.
Capability language applies only to actions routed through Fulcrum-controlled or Boundary-controlled paths and does not cover tools that bypass the boundary.
Open source MIT · proofs · public
Walk · 04 — Routing
One routed action, one threshold. The boundary evaluates, verifies, and diverts by verdict: ALLOW continues to the record, DENY peels to the reject line, and ESCALATE is held for review.
Fulcrum evaluates whether a routed action may proceed before execution and preserves the captured decision for review afterward.
Authentication does not establish legal admissibility. “Admissibility” here is the boundary decision about whether the routed action may proceed, not a legal conclusion.
Hash-verifiable decision records let an independent verifier recompute record integrity without Fulcrum credentials.
Record integrity is not verdict correctness, enforcement proof, completeness, authenticity by itself, or legal admissibility. Replay reproduces a recorded decision; it does not prove enforcement or the absence of upstream side effects.
Evaluation access
We use the first evaluation to scope the action your team wants governed before execution and determine whether Fulcrum is the right fit for that initial rollout.
