Someone asks what your agents did on a resource, or what happens if you leave. Intramedial answers from an append-only record, scoped to what the reader may see, and proves the export complete and unaltered.
civics.records ledger.blame exit.objectives ledger-bundles.snapshot Put admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseAn export you built for the occasion is hard to trust. The reader cannot tell what was left out, and you cannot show it matches what was recorded.
What did our agents do on this resource, in order?
What can this reader see, and what is hidden from them?
If we leave, can we get everything out, and prove we did?
The records search answers the first, the disclosure level the second, and the exit objectives with a signed bundle the third. The ledger is append-only: retention and redaction are a policy choice, not a call.
AppliesSince 25 May 2018
A person may ask a controller for access to the personal data held about them. Answering needs a record you can search and export, scoped so that it does not expose other people’s data.
Official text ↗AppliesOngoing
Customers ask what happens to their data when they leave. Published recovery objectives, measured beside what was promised, make the answer checkable.
Legal references are summarised and dated as of October 2026. They are given so you can see where the need comes from, not as legal advice. Read the official text, and ask counsel how it applies to you. Intramedial does not make any organisation compliant with any law.
Records search lists events with actor, resource and kind. Give a resource to see who touched it last; leave it out to read the workspace’s events.
A caller without the export permission gets the same fields with witness handles removed, so disclosure is scoped without a second query.
Exit shows each recovery objective next to what was measured, and which were missed or never verified.
You seal a stretch of the chain into a bundle that names its range. Anyone can verify it against the published key without asking Intramedial.
Each module decides one kind of thing. Open a module for its fields, limits and errors.
A Trustvice Product
civics.recordsSearches the workspace record by resource, with disclosure scoped to the caller.
Open module →ledger.blameBlames a resource to list each agent that changed it, in order, and replays any event.
Open module →exit.objectivesShows recovery objectives beside measured results, and proves an export complete.
Open module →ledger-bundles.snapshotSeals a signed, offline-checkable bundle of the chain range you name.
Open module →Acme reads the record for repo:payments/main for a customer’s auditor, then seals a signed bundle that the auditor verifies on their own machine.
curl -sS "https://api.intramedial.com/api/v1/acp/civics/records?resource=repo:payments/main" \
-H "Authorization: Bearer $INTRAMEDIAL_KEY"{}
→ 200 { bundle }Request fields as documented: /docs/ledger-bundles-snapshot
A ledger entry is evidence of a narrow fact: this decision was made on this input under this policy at this time, and the chain has not changed since. It is not a certificate, an audit or legal advice, and it does not by itself satisfy any legal obligation.
Keep the decisions your agents were allowed to make, under which rule, in a record an auditor can check without asking you.
mandates.compile coordination.admit conformity.sweep compliance.pack Hold a risky intent until a person approves it, and make destructive changes wait for a second, different person.
coordination.approve dual-control.scopes civics.asks coordination.admit Stop one agent or the whole workspace in a single step, then map what it touched before you undo anything.
watchdog.check coordination.halt ledger.blame remediation.blast The Try it terminal runs the real admission kernel on your machine. It needs no account and sends nothing, and each decision comes back with its reason.
