GREENLIGHT

GREENLIGHT is the independent runtime authority for AI agent actions. Before an AI agent does something that matters — move money, change a record, contact a customer — GREENLIGHT decides whether it should happen: allow it, require human approval, escalate it, or block it. Every allowed action earns an execution visa, and every decision is recorded as proof. Crelis authorizes or routes the action; your own system executes it.

No. The final decision is never made by an AI model. It is made by fixed, deterministic rules — so the same request always gets the same answer, and every answer can be explained. AI signals can inform the decision; they can never be the decision.

No. Day one is SHADOW mode: one small configuration change, nothing else touched — and you immediately see a complete, audit-ready record of each consequential action your AI agents attempt through Crelis, alongside what policy would have said. ADVISORY and ENFORCE are modes you switch on later, per organisation, at your own pace.

Nothing breaks. Systems that don’t know about Crelis keep working exactly as they do today, while each consequential action routed through Crelis is still checked and recorded. You bring each system under ENFORCE only when you’re ready.

Any agent whose consequential actions you route through Crelis — model- and vendor-neutral by design. Crelis evaluates what an agent tries to do, not how the model works inside, so agents built on different models, vendors and frameworks are authorized the same way, and switching AI vendors doesn’t change your controls. Tested so far with the agents and SDKs running in our hosted pilot environment; no vendor is certified or endorsed.

The safe thing: consequential actions fail closed — if authority can’t be determined, they wait and are never silently allowed. Routine work is not held hostage: an organisation can run in ADVISORY mode, where nothing is blocked, and execution visas already issued can still be verified for signature and binding without calling Crelis (replay and revocation checks need Crelis online). Bluntly: our outage can pause a consequential action; it cannot approve one.

Crelis is designed to decide on decision metadata — what was requested, what was decided, and proof it happened — not on raw personal data. A decision needs “identity: not verified”, not the identity document, so your integration keeps personal information, account numbers and message contents out of the request. That shrinks your compliance surface rather than expanding it.

Each execution visa is single-use, expires in seconds, and is locked to one specific action for one specific system. Stolen, it is of little use to an attacker — by design it can’t be reused, redirected, or stretched to cover another action. And a stolen password or API key alone is no longer enough to act, because the visa is also required.

No. Every customer has its own sealed identity inside Crelis. An execution visa issued for one customer simply does not work for any other — the separation is enforced by the engine, not just a settings switch.

Partly, and we are precise about it: an automated adversarial (“red-team”) test suite runs in CI on every build — if a defence weakens, the build fails. No third-party penetration test has been performed yet; one is on the roadmap ahead of customer deployments.

Crelis is patent-pending: our first application, covering the core authority runtime, was filed in Singapore, and we continue to invest in protecting the architecture as it matures.

Two options, chosen per system. In both, Crelis decides and your own system carries out the action — Crelis never executes it. The first is the optional Crelis gateway: consequential requests are routed through it, and it forwards to your system only what policy allows, which then executes — your systems don’t change at all. The second is the check at the door: your own system verifies the Crelis execution visa before it executes — your team switches that check on once. Everyday read-only work is untouched in both.

Not on day one, and for many systems never. SHADOW and ADVISORY require zero changes anywhere. ENFORCE is a choice per system: either route consequential actions through the optional Crelis gateway (no backend change), or have your system verify execution visas at its own door — a small, standard step your team enables when ready.

We never rely on the agent’s good behaviour — that’s the whole point. Depending on the setup, either the agent has no direct route to the sensitive system except through the gateway, or the system itself refuses consequential actions that arrive without a valid Crelis execution visa. A misbehaving or manipulated agent gets a clean refusal — and the attempt goes on the record.

They may build something similar — inside their own ecosystem. Crelis is deliberately independent: one place that decides authority across the AI ecosystems a company uses, rather than a feature that optimises for a single vendor’s stack. That neutrality is the point, and it is structurally hard for a platform to offer.