Nuggets launched Authority Control Plane (ACP), an enterprise platform that enforces what autonomous AI agents are authorized to do and generates cryptographic proof of every authorization decision. The platform sits in the execution path between agents and the systems they interact with, evaluating identity, authority, policy, and runtime context before any action proceeds.
The Authorization Problem
Enterprise teams building agent systems face a specific governance gap: when an autonomous agent takes an action, there is no standardized way to prove who authorized it, under what conditions, and whether those conditions were met at execution time. According to co-founder and CCO Seema Khinda Johnson, “Customers told us they can’t move agents to production, because they can’t prove what an agent was allowed to do,” as reported by Biometric Update.
ACP addresses this by making authorization mechanistic rather than contractual. A verified person assigns authority to an agent for specific operations, including which systems it may access, what actions it may take, spending thresholds, expiration dates, and conditions requiring human approval. When the agent attempts an action, ACP evaluates the request against those boundaries and either permits, denies, or refers it for human review.
How It Works
The authorization chain connects a verified person, their organization, and the agent through decentralized identifiers and verifiable credentials. Authority granted to an agent is issued as a separate credential describing permitted actions and conditions.
Each decision produces a signed Action Receipt recording the agent, the authority it used, the requested action, and the outcome. Nuggets says customers, auditors, and regulators can verify receipts without accessing internal logs, according to Biometric Update.
Nuggets offers a procurement agent as the reference example: an organization authorizes an agent to purchase from approved suppliers up to a spending cap. Transactions exceeding that cap get referred to a human approver. The agent can connect to purchasing tools, but its authority credential determines which suppliers, values, and actions are acceptable.
Competitive Landscape
ACP enters a crowded week for agent governance infrastructure. Neo emerged from stealth with $100M to inventory and govern enterprise agents. Sophos released its AI Security 2026 report identifying agent identities as the fastest-growing attack surface. Box shipped agent guardrails through Shield Pro. Harness extended its CI/CD platform with Agent DLC for agent lifecycle governance.
Nuggets occupies a specific slice: execution-time authorization enforcement with cryptographic accountability. Where Neo focuses on agent inventory and visibility, and Sophos on threat modeling, ACP targets the moment an agent acts and whether it had permission to do so. The company previously built verified identities for AI agents, an enterprise governance framework, and the open-source langchain-nuggets integration.
The Compliance Infrastructure Bet
The clustering of agent governance launches reflects a market signal: enterprises are deploying agents faster than they can audit them. Authorization, the ability to prove what an agent was allowed to do and whether it stayed within bounds, is becoming a compliance infrastructure requirement rather than a feature checkbox. Nuggets is betting that the gap between agent deployment pace and governance maturity creates demand for purpose-built enforcement tooling, not bolted-on controls in existing IAM or chatbot interfaces.