Orbit Authority Action Control

Control sensitive actions before they execute.

For payments, trades, and AI-built app side effects, Orbit Authority checks whether the actor has permission, whether the action is in scope, and whether approval is required.

Orbit does not replace Stripe, your broker, or your app. It is the decision point before those systems are called.

See Action Control

Orbit Authority cockpit

Action Control cockpit

Sample cockpit view: payments, trades, and app mutations receive the same allow/escalate/block decision shape.

Sample queue view

policy: no-prod-writes · Production changes need explicit approval.policy: spend-limit-5k · Over $5k needs approval.policy: human-approval-required · A named owner must approve.policy: standing-refunds-500 · Refunds under $500 can proceed.policy: secret-access-blocked · Secret paths are blocked.

Actor	Requested action	Surface	Risk	Verdict
Billing workflow	refund.create $250	Payment	Medium	ALLOW
Trading Agent	buy NVDA $42,000	Trading	Critical	BLOCK
Admin agent	db.users.updateMany	App	High	ESCALATE
Finance bot	payout.create $8,000	Payment	High	ESCALATE

Click any requested action, or press Enter or Space while focused, to inspect its policy and receipt details.

The authority loop

Actor requests a consequential action.

workflow: send an $8,000 payout

Orbit Authority checks authority and scope.

policy: over your $5k limit, identity verified

Allow, escalate to a human, or deny.

Asks you first, before the payout goes out.

Receipt and audit trail recorded.

A signed receipt records who, what, the policy, the decision, and who approved.

From action intent to verdict to visible proof.

Action Control is not just a log. Where ORBIT can block before the action runs, it does; where it can only watch, it says so.

Runtime action event

Your tool reports the action before it runs.

Canonical ORBIT action

ORBIT turns the action into one standard record — who, what, which account, and which policy applies.

Agent Policy evaluation

Your policies combine safely: the strictest rule wins, anything uncertain gets escalated, and a standing approval can never grant more than the base policy allows.

Verdict and receipt

The result is allow, ask, or block, with a signed receipt.

One decision loop before every high-stakes side effect.

Each request resolves to a clear decision — allow, ask, or block — and leaves a signed receipt an operator or auditor can read.

/payments

Payments & Transactions

Let routine billing work run, but stop or escalate anything outside amount, merchant, account, or actor scope before Stripe is called.

Action requested	Decision	Why	Receipt says
refund.create USD 250	ALLOW	Under $500 standing refund approval.	Receipt says refund was authorized by standing approval before execution.
payout.create USD 8,000	ASK	Above your $5k limit; needs your approval.	A signed receipt records who, the account, the amount, the policy, and who approved.
charge.create USD 12,400	BLOCK	Merchant and invoice scope do not match the active workflow.	Denial receipt records the failed scope check; money never moves.

/trading

Autonomous Trading

Put mandate, exposure, asset-class, drawdown, and market-hours limits between the model and the broker execution path.

Action requested	Decision	Why	Receipt says
trade.execute NVDA $42,000	BLOCK	Order exceeds trading mandate.	Denial receipt captures instrument, notional, mandate version, and circuit-breaker state.
position.close TSLA 15%	ALLOW	Risk-reduction action inside existing position scope.	Authorization receipt proves the close was evaluated before the broker call.
trade.execute BTC perpetual	ESCALATE	New asset class requires a mandate exception.	Escalation receipt names the requested exception and timeout fallback.

/apps

Agentic Apps

Give AI-built products a runtime checkpoint before customer records, emails, plans, or destructive app mutations become real.

Action requested	Decision	Why	Receipt says
db.users.updateMany plan=enterprise	ESCALATE	Bulk customer mutation requires human review.	Receipt links the mutation shape, table scope, policy, reviewer, and decision.
send campaign to 18,420 users	ESCALATE	External communication crosses volume threshold.	Receipt records audience size, template hash, sender authority, and approval path.
delete account acct_9K2	BLOCK	Destructive action lacks verified customer request.	Denial receipt proves the delete was blocked before application state changed.