Ask the plane whether an agent may act on a connected SaaS source, and read the verdict before anything is sent.
saas.admitPut admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseAn agent works in a SaaS tool such as GitHub or a ticket system. You want each action admitted first. The admit route returns a verdict and sends nothing to the SaaS.
The code reads the key from INTRAMEDIAL_KEY. Keep it in your shell or your secret store, never in a file you commit. Calls that need a signed-in person cannot use a key: the console makes them.
Send the source, the agent and the action. An action defaults to read.
A Trustvice Product
saas.admitsaas-admit
curl -sS -X POST https://api.intramedial.com/api/v1/acp/saas/admit \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" \
-H "Content-Type: application/json" \
-d '{
"source": "github",
"actorDid": "did:web:acme.example:agent:support",
"action": "write"
}'const res = await fetch("https://api.intramedial.com/api/v1/acp/saas/admit", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
source: "github",
actorDid: "did:web:acme.example:agent:support",
action: "write",
}),
});
console.log(res.status, await res.json());import os, requests
res = requests.post(
"https://api.intramedial.com/api/v1/acp/saas/admit",
headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
json={
"source": "github",
"actorDid": "did:web:acme.example:agent:support",
"action": "write",
},
timeout=30,
)
print(res.status_code, res.json())result.allow and result.reason are Intralock's answer, with no model on the path. A write that needs confirmation adds an approvalId to the result.
{
"result": { "allow": false, "reason": "no_grant" },
"llm": false
}An administrator can give a source a write map. The write route then admits, forwards and logs. With no map it returns 404.
Copied from: /docs/saas-admit
write calls are.The ledger is append-only and sealed under Merkle roots. The time on an entry is Intramedial's own clock, and a signed bundle can be checked offline with the published key.
Ask the MCP gateway for Intralock's verdict on an agent's tool call, read the reason, and list the callers it has seen.
mcp.enforceAdmit an agent's write to a repository through Intralock and post the verdict to the commit as a check run or status.
github.enforceLet a refused write wait in the approval queue until a signed-in person approves it, then retry with the token.
coordination.approveOne short email when we add recipes to the cookbook. No other mail, and you can unsubscribe from any message.
No key or account: Try it on the coordination.admit module page runs the real kernel in your browser. Use a workspace key for your own workspace.