Declare a write with coordination.admit, read the refusal and its reason, and find the request it left behind.
coordination.admitPut admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseYou want to see the whole loop once before you build anything: an agent declares an intent, Intralock answers allow or deny with a reason, and a refused write leaves a request for a person. No model is on the path.
A Trustvice Product
curl and jq, Node 18 or later, or Python with requestsThe code reads the key from INTRAMEDIAL_KEY. Keep it in your shell or your secret store, never in a file you commit. Calls that need a signed-in person cannot use a key: the console makes them.
Open the module page and run Try it. It runs the real kernel in your browser, with no key and no account. Change the verb or the resource and watch the reason change.
Send the actor, the resource and the verb. A write or a delete needs a confirmation token, so with none it is refused. Export your workspace key as INTRAMEDIAL_KEY first.
The call answers 200 OK. allow is false, the reason is confirmation_required, and llm is always false: no model decided.
{
"result": { "allow": false, "reason": "confirmation_required", "approvalId": "apr_7f3a" },
:
}confirmation_required.coordination.admitcoordination-admit
curl -sS -X POST https://api.intramedial.com/api/v1/acp/coordination/admit \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" \
-H "Content-Type: application/json" \
-d '{
"actorDid": "did:web:acme.example:agent:billing",
"resource": "repo:payments/main",
"action": "write"
}'const res = await fetch("https://api.intramedial.com/api/v1/acp/coordination/admit", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
actorDid: "did:web:acme.example:agent:billing",
resource: "repo:payments/main",
action: "write",
}),
});
const body = await res.json();
console.log(res.status, body);import os, requests
res = requests.post(
"https://api.intramedial.com/api/v1/acp/coordination/admit",
headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
json={
"actorDid": "did:web:acme.example:agent:billing",
"resource": "repo:payments/main",
"action": "write",
},
timeout=30,
)
body = res.json()
print(res.status_code, body)result.allow is the verdict. A refusal names its reason, and for a missing token approvalId names the request it left in the queue.
curl -sS -X POST https://api.intramedial.com/api/v1/acp/coordination/admit \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" \
-H "Content-Type: application/json" \
-d '{"actorDid":"did:web:acme.example:agent:billing","resource":"repo:payments/main","action":"write"}' \
| jq '.result'const { result } = body;
if (result.allow) {
console.log("admitted");
} else {
console.log("refused:", result.reason, result.approvalId ?? "");
}result = body["result"]
if result["allow"]:
print("admitted")
else:
print("refused:", result["reason"], result.get("approvalId", ""))The refused write now waits in the approval queue for a person, and the agent retries with the token they issue. Reads and other verbs are admitted from the grants a mandate compiles, so write a mandate next.
Copied from: /docs/coordination-admit
detection.run.The ledger is append-only and sealed under Merkle roots. The time on an entry is Intramedial's own clock, and a signed bundle can be checked offline with the published key.
Take an exclusive lease on a resource with coordination.lease, see who holds it, and let it go when you are done.
coordination.leaseLet a refused write wait in the approval queue until a signed-in person approves it, then retry with the token.
coordination.approveAsk the MCP gateway for Intralock's verdict on an agent's tool call, read the reason, and list the callers it has seen.
mcp.enforceOne short email when we add recipes to the cookbook. No other mail, and you can unsubscribe from any message.
No key or account: Try it on the coordination.admit module page runs the real kernel in your browser. Use a workspace key for your own workspace.