Send nine datasets, each with a completeness declaration, then read the eight metrics and the ranked recommendations to move resources from observe to enforce.
conflict.audit-latestPut admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseYou want to know where agents collide and which resources should move from observe to enforce. The engine derives eight metrics from datasets you supply, and a metric reads incomplete unless its datasets are complete.
A Trustvice Product
policies.propose the narrowest permission the doc names for this stepidempotencyKey of at most 128 characters that is new for each inputpolicies.propose permission, to generate a reportThe code reads the key from INTRAMEDIAL_KEY. Keep it in your shell or your secret store, never in a file you commit. Calls that need a signed-in person cannot use a key: the console makes them.
Send the window, an idempotencyKey, a completeness entry for each of nine datasets and the datasets as explicit arrays, even when empty. The same key with different input is refused with 409.
conflict.audit-latestconflict-audit-latest
curl -sS -X POST https://api.intramedial.com/api/v1/acp/conflict-audit/generate \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" \
-H "Content-Type: application/json" \
-d '{
"windowStart": "2026-10-02T09:00:00.000Z",
"windowEnd": "2026-11-01T09:00:00.000Z",
"idempotencyKey": "audit-2026-11-01",
"completeness": {
"registeredAgents": "complete",
"shadowIdentities": "unknown",
"shadowActions": "unknown",
"admissions": "incomplete",
"leases": "complete",
"waiters": "incomplete",
"ledgerEvents": "complete",
"detectorFindings": "complete",
"frtFindings": "unknown"
},
"registeredAgents": [],
"shadowIdentities": [],
"shadowActions": [],
"admissions": [],
"leases": [],
"waiters": [],
"ledgerEvents": [],
"detectorFindings": [],
"frtFindings": []
}'const res = await fetch("https://api.intramedial.com/api/v1/acp/conflict-audit/generate", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
windowStart: "2026-10-02T09:00:00.000Z",
windowEnd: "2026-11-01T09:00:00.000Z",
idempotencyKey: "audit-2026-11-01",
completeness: {
registeredAgents: "complete",
shadowIdentities: "unknown",
shadowActions: "unknown",
admissions: "incomplete",
leases: "complete",
waiters: "incomplete",
ledgerEvents: "complete",
detectorFindings: "complete",
frtFindings: "unknown",
},
registeredAgents: [],
shadowIdentities: [],
shadowActions: [],
admissions: [],
leases: [],
waiters: [],
ledgerEvents: [],
detectorFindings: [],
frtFindings: [],
}),
});
console.log(res.status, await res.json());import os, requests
res = requests.post(
"https://api.intramedial.com/api/v1/acp/conflict-audit/generate",
headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
json={
"windowStart": "2026-10-02T09:00:00.000Z",
"windowEnd": "2026-11-01T09:00:00.000Z",
"idempotencyKey": "audit-2026-11-01",
"completeness": {
"registeredAgents": "complete",
"shadowIdentities": "unknown",
"shadowActions": "unknown",
"admissions": "incomplete",
"leases": "complete",
"waiters": "incomplete",
"ledgerEvents": "complete",
"detectorFindings": "complete",
"frtFindings": "unknown",
},
"registeredAgents": [],
"shadowIdentities": [],
"shadowActions": [],
"admissions": [],
"leases": [],
"waiters": [],
"ledgerEvents": [],
"detectorFindings": [],
"frtFindings": [],
},
timeout=30,
)
print(res.status_code, res.json())The latest route returns the newest report, or 404 before any exists. The report id comes from its digest, so the same inputs give the same report. A metric reads incomplete unless every dataset it uses is declared complete.
curl -sS https://api.intramedial.com/api/v1/acp/conflict-audit/latest \
-H "Authorization: Bearer $INTRAMEDIAL_KEY"const res = await fetch("https://api.intramedial.com/api/v1/acp/conflict-audit/latest", {
headers: { Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`, },
});
const body = await res.json();
const { report } = body;
for (const rec of report.recommendations) {
const { from, to, gated, gateReason } = rec.proposedAction;
console.log(rec.resourceUrns.join(", "), from, "to", to, gated ? "gated: " + gateReason : "open");
}
console.log(report.limitations);import os, requests
res = requests.get(
"https://api.intramedial.com/api/v1/acp/conflict-audit/latest",
headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
timeout=30,
)
body = res.json()
report = body["report"]
for rec in report["recommendations"]:
p = rec["proposedAction"]
print(", ".join(rec["resourceUrns"]), p["from"], "to", p["to"], "gated: " + p["gateReason"] if p["gated"] else "open")
print(report["limitations"])Each recommendation proposes a move from observe to enforce for resources. One under 0.65 confidence is gated and cannot be adopted; gateReason says why, and limitations lists what is missing.
Adoption is a separate flow. A confirm needs a reason and the phrase ADOPT <workspaceId>, and an apply needs the single-use token it returns and an adopter service.
Copied from: /docs/conflict-audit-latest
The ledger is append-only and sealed under Merkle roots. The time on an entry is Intramedial's own clock, and a signed bundle can be checked offline with the published key.
List the detectors, run lease-overlap, and read the conflicts it cites with their evidence, then read the cases it filed for review.
detection.runDrop or add a grant in a copy of the policy, probe it, and read each verdict before and after the change.
drills.counterfactualRead the ledger for bursts, spikes and silence in lease and credential events, and run the check from your own scheduler.
watchdog.checkOne short email when we add recipes to the cookbook. No other mail, and you can unsubscribe from any message.
No key or account: Try it on the coordination.admit module page runs the real kernel in your browser. Use a workspace key for your own workspace.