dual-control.scopesModule 22Require two different administrators before the plane's most destructive actions run, and see whether the break-glass seal is intact.
dual-control.scopes lists the eight actions that need two people. One administrator requests a scope with the exact body, another approves it, and the gated route runs only with that warrant. The same route reports the break-glass seal and how many requests are still open.
Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abusekill-switch can be requested and approved, but no route checks for its warrant, so approving it stops nothing. Use the administrator-only stop routes under coordination for stops, and do not rely on this scope to hold one.
Plane module
scopesquarantine, revoke-grant, revoke-tenant, revoke-verification, teardown-yard, kill-switch, reseal and restore-workspace./docs/dual-control-scopesAPI referenceRoutes, bodies and status codes./docs/dual-control-scopesOpen the consoleSee the module at work in the dashboard, on a seeded fleet or your own./app/dual-controlStart freeCreate a workspace and admit your first intent./auth/signup
sealintact, and when broken brokenBy, brokenAt, why and witnessedBy.openrequestrequest: the stored request, with the digest returned beside it.digestdecisionapprove and decide: whether the request now holds a valid warrant.refusedWithoutdecide: the reason a warrant was not issued.An administrator posts a scope and the exact body of the action. The plane returns the request and a digest, the canonical form of the request that approvers sign.
approve takes the requestId and the digest. The approver must be a different signed-in administrator with MFA in the last 12 hours.
decide checks that enough distinct people approved and returns the warrant, or says what was missing in refusedWithout.
The gated routes answer 403 unless the request carries a warrant for that scope and body. Seven routes are gated today.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private. dual-control.scopes docs
Press Run to send the request on the left to the shared demo workspace.
Runs in a shared demo workspace with a demo key: anyone can see what it holds, so send nothing private.
A request in the shape the API accepts, and an example response in the shape the module returns.
GET /api/v1/acp/dual-control/scopes Authorization: Bearer av_workspace_•••• → 200 { scopes, seal, open }
{
"scopes": [
"quarantine",
"revoke-grant",
"revoke-tenant",
"revoke-verification",
"teardown-yard",
"kill-switch",
"reseal",
"restore-workspace"
],
"seal": {
"intact": true
},
"open": 0
}One administrator requests a quarantine for a misbehaving agent, a second reads the digest and approves it, and only then does the quarantine route run.
Cutting a tenant's delegation affects people outside the team. Two administrators have to agree before tenancy/revoke goes through.
A yard holds running work. The teardown route stays closed until two administrators have approved this exact teardown.
In an emergency an administrator breaks the seal with a reason. The break is written to the ledger first, and re-arming it takes two people.
coordination.approve.coordination.halt, which one administrator can set alone.A module is a strong claim about a narrow thing. Rely on it for exactly what it is.
stale_digest.dual-control.break-glass event to the ledger before anything else happens.kill-switch has none.coordination/quarantine, coordination/revoke, tenancy/revoke, yards/teardown, packs/revoke-verification, adapters-github/revoke and remediation/execute.
self_approval, same_principal, not_human, no_mfa, wrong_request, stale_digest, expired, insufficient, requester_not_human, not_administrator and requester_not_administrator.
A warrant of kind adjudicated stands in for the second person when an arbitration case at rung 3 or 4 carries a matching remedy and subject.
While the seal is broken, only the person who broke it may proceed, and only after a refusal. Re-arming takes the reseal scope, approved by two people.
ttlMs says otherwise.glass is administrator-only at the route as well as in the module.Authenticate with a workspace API key as a Bearer token. The base URL is https://api.intramedial.com.
/api/v1/acp/dual-control/scopesList the fixed scopes, the seal state and open requests./api/v1/acp/dual-control/requestsList dual-control requests and their approvals./api/v1/acp/dual-control/requestOpen a request for one scope with its exact body./api/v1/acp/dual-control/approveApprove a request by signing its digest./api/v1/acp/dual-control/decideCheck a request and return its warrant./api/v1/acp/dual-control/glassBreak the seal with a reason, ledgered first./api/v1/acp/dual-control/sealRead the seal, or re-arm it with an approved reseal./api/v1/acp/dual-control/gateAsk whether a route is gated and what its gate decides.This module has no MCP action. Call it over REST from any agent or program.
coordination.approve05Human approval queueHold a risky write or delete until a signed-in person approves it, with the agent, resource and verb in front of them.tenancy.tree18Tenant tree and reachModel resellers and their customers as a tree, and compute who can reach each branch from delegations instead of storing it.coordination.quarantine32Agent quarantineCut one agent off at admission, but only with the second person's approval or a ruling that names that exact agent.coordination.admit01Intralock admissionDecide every action before it happens: an agent declares its intent, and Intralock admits it or names the reason it may not.coordination.lease02Resource leases and queuesHold a resource for one agent at a time, with a lease that lapses on its own and a queue for the agents that have to wait.civics.claims20Resource claims officeLet an agent state what it is about to work on before it takes a lease, and open a case when two claims collide.metering.snapshot21