An action authorization plane for autonomous systems.

KTP defines a Policy Decision Point and a set of Policy Enforcement Points applied to agent actions, not just network or identity events. The PDP evaluates each attempted action against identity, intent, context, resource, trajectory, and policy. The PEPs sit at every surface where motion can occur: tool gateways, API gateways, data layers, identity layers, egress, and transaction systems.

The decision function returns one of five outcomes: ALLOW, CONSTRAIN, VETO, ESCALATE, or REVOKE. Telemetry from every decision flows to Splunk as the system of record; SOAR handles response when a constraint or veto fires.

Everything above answers one question: can the agent act here. There is a second question the control plane has to answer, and almost no stack does: should it act, right now. An agent can be fully authorized, the environment calm, every control green, and still be one step from the wrong action for the moment. A comms agent cleared to send the quarterly newsletter, an hour after the layoffs were announced. Authorized is not the same as appropriate.

The should gate runs upstream of the policy engine, where the flow diagram places the Tamed Autonomy layer. It is conjunctive, evaluated per moment-category: an action clears it only if it passes both a physics check and a normative check.

W is the weight of the moment; J is the judgment the agent has earned for a moment like this. W is not a single number. It splits in two. W_stability is the part telemetry can read: heat, momentum, an open incident, a change-freeze window. W_normative is the part with no signal: a layoff, a regulated quiet period, a response out of all proportion. The physics reads the first. It cannot read the second.

The normative half is not one job. Sort each appropriateness fact by whether it leaves a telemetry signature and whether it is slow and settled or fast and novel. Three of the four corners can be built. The fourth, a fact that is both fast and signatureless, has no physical home and has to be routed to a person.

KTP is the engine that can act on a should. It enforces a normative verdict by de-automating or vetoing. It does not author one. That judgment is supplied by Tamed Autonomy, the work of Robin Martherus: authenticate the purpose, not just the identity. KTP supplies the gate; Tamed Autonomy supplies the judgment. The two-gate architecture, can and should, is the subject of a piece the two of us are writing together.

Seven places to put a Policy Enforcement Point. The Tool Gateway is the load-bearing one: if you do nothing else, centralize tool access, enforce policy there, log everything. That alone covers a large portion of the top risks.

The 337 Core + Strong KTP risks cluster tightly. You do not need 337 controls. You need ten. Each set names what it covers, what you build, the decision it produces, examples, and where it lives in the stack. Control Set 1 is open by default; the rest are collapsed.

People classify AI risk by nouns: misinformation, privacy, bias, autonomy, fraud. KTP classifies by verbs. The risk universe is large; the control vocabulary is small. The verb is where governance becomes enforceable, but the action tuple is what makes it safe. For the empirical case behind this collapse, see risks.

Classic security gives the user the least privilege necessary. But autonomous agents create a new problem: even with least privilege, an agent can combine allowed actions into an unsafe sequence. Each verb may be acceptable. The chain may not be.

So KTP adds a second constraint above least privilege: least trajectory. Not only what permissions does the agent have, but what sequence of movements is the agent allowed to take. Trust attaches to paths, not actors. An agent may be trusted at step 1 and untrusted by step 5.