Some actions should never be a model’s call alone. Intramedial parks the intent in an approval queue, accepts a decision only from a signed-in person, and asks a second administrator for the destructive ones.
coordination.approve dual-control.scopes civics.asks coordination.admit Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseA Slack message asking “okay to proceed?” is not an approval. Nobody can show who said yes, to which action, or whether the requester said it themselves.
Who approved this exact action, and when?
Could the requester have approved it themselves?
Did anyone besides the first administrator have to agree?
The queue answers the first two, and dual control answers the third. A token or an agent cannot decide, and nobody approves a request of their own.
AppliesSince 25 May 2018
A person has the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, with exceptions. Where an exception applies, safeguards include the right to obtain human intervention.
Official text ↗AppliesOngoing
Auditors expect destructive changes to need two people. A rule enforced by the system is easier to defend than one written in a handbook.
Legal references are summarised and dated as of October 2026. They are given so you can see where the need comes from, not as legal advice. Read the official text, and ask counsel how it applies to you. Intramedial does not make any organisation compliant with any law.
Admission finds that the mandate requires approval, so the intent waits in the queue with its context instead of running.
The approver reads what the agent wants and approves it, or denies it with a reason. A request cannot be approved by its own requester.
Approval or denial, the reason and both lifetimes are written to the ledger next to the intent.
Eight scopes, such as quarantine or revoking a grant, stay pending until a second administrator confirms the request.
Each module decides one kind of thing. Open a module for its fields, limits and errors.
A Trustvice Product
coordination.approveHolds gated intents for a signed-in person, who approves or denies with a reason.
Open module →dual-control.scopesRequires a second, different administrator for eight destructive scopes.
Open module →civics.asksLets an agent ask a person a question with an urgency and a deadline, and keeps the answer.
Open module →coordination.admitShows the gated intent among the leases and agents it concerns.
Open module →Acme’s support agent wants to bulk-update customer records. The intent waits for a named approver, who approves with the reason “expected batch”.
curl -sS https://api.intramedial.com/api/v1/acp/coordination/approve \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" \
-H "Content-Type: application/json" \
-d '{
"id": "apr_1",
"reason": "expected batch"
}'→ 200 { scopes, seal, open }Request fields as documented: /docs/coordination-approve
A ledger entry is evidence of a narrow fact: this decision was made on this input under this policy at this time, and the chain has not changed since. It is not a certificate, an audit or legal advice, and it does not by itself satisfy any legal obligation.
Stop two agents from writing to the same repository, table or slot at once, and show which one held it and why the other waited.
coordination.admit mandates.compile detection.run ledger.blame Stop one agent or the whole workspace in a single step, then map what it touched before you undo anything.
watchdog.check coordination.halt ledger.blame remediation.blast Keep the decisions your agents were allowed to make, under which rule, in a record an auditor can check without asking you.
mandates.compile coordination.admit conformity.sweep compliance.pack The Try it terminal runs the real admission kernel on your machine. It needs no account and sends nothing, and each decision comes back with its reason.
