Observed Signal · Mar 23, 2026 · Technical Release · Source: DEV Community · Impact: 3/5 · Sentiment: Positive
Zehrava Gate: Write-Path Control Plane for AI Agents
A developer describes Zehrava Gate, an open-source, self-hosted write-path control plane for AI agents that enforces deterministic, auditable policies before any agent performs real-world writes. Gate supports a cooperative SDK mode (V2) where agents call Gate.propose() and an enforced proxy mode (V3) that routes outbound HTTP traffic through Gate using HTTP(S)_PROXY. Policies are expressed in YAML (no LLMs) and can auto-approve, require human review, or block intents; Gate issues signed execution orders, logs every decision, supports idempotency checks and a vault mode that fetches short-lived credentials (1Password or HashiCorp Vault) only after approval. The project is MIT licensed and published on npm and PyPI.
Introduces an open-source, auditable enforcement layer for agent-initiated writes that can reduce operational and legal risk when AI agents act on production systems—relevant to organizations deploying agentic workflows but not a major-platform policy change.
Track Amazon Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Zehrava Gate is an open-source, MIT-licensed write-path control plane for AI agents that evaluates intents against deterministic YAML policies before writes.
- Gate V2 provides a cooperative SDK (JS and Python examples) where agents call Gate.propose(); Gate V3 adds a network proxy that enforces policies by routing outbound HTTP(S) through Gate via HTTP_PROXY/HTTPS_PROXY.
- Policies support auto-approve, require human approval, block rules (e.g., prohibited terms), idempotency/duplicate blocking, and TTL/expiry for pending approvals.
- Gate issues signed execution orders (short-lived token), logs every decision for auditability, and supports a vault mode that fetches production credentials from 1Password or HashiCorp Vault at execution time.
- The post cites real-world AI agent failures at Air Canada, Cursor, Replit and Amazon as motivation for centralized, auditable write controls.
Connected Companies & Entities
7 Entities mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Pre-Execution Gates: First Line of Defense for AI
The article explains the architectural pattern of pre-execution gates — decision checkpoints that evaluate whether an action should run before any side effects occur. Unlike scattered validation checks, gates are implemented as a decoupled, policy-driven layer that logs every decision for auditability and makes refusal a first-class outcome. The author outlines core design principles (synchronous pre-state evaluation, policy-driven rules, composability, and comprehensive logging), practical tradeoffs (added latency, policy management complexity, harder debugging), and recommended start-up steps (identify high-risk actions, map existing authorization logic, define policy models, and measure gate latency and policy change velocity). The post cites industry data on centralized policy enforcement benefits and points readers to Tailored Techworks for further implementation experience.
Cert‑gating Tool Calls for Zero‑Trust AI Agents
A developer describes an open‑source agent security kernel that enforces zero‑trust for AI agents by cert‑gating every tool invocation. The kernel requires all tool calls to pass through an enforce_policy function which validates strict JSON schemas, attaches provenance-tagged values (pv/Prov), enforces taint-flow invariants (TAINTED never becomes TRUSTED), and checks scoped, time‑limited, budgeted capability tokens. Successful checks mint signed artifacts (e.g., TOOL_CALL_CERT.v1, TAINT_FLOW_CERT.v1) and all events are recorded in an append‑only Merkle trace; failures emit structured obstruction artifacts (PROMPT_INJECTION_OBSTRUCTION.v1). The project is MIT licensed, available at github.com/1r0nw1ll/agent-security-kernel, and published as a pip package. The design targets multi‑model orchestration use cases (Claude, GPT/Codex, open‑source models) and aims to close provenance-based prompt‑injection gaps.
Pre-Action SRE Gate for Safe Autonomous Agents
The author proposes a concrete resilience pattern — the Pre-Action SRE Gate — that agents must run before executing any autonomous, state-changing action in production. The gate performs three programmatic checks: error budget headroom, Approval Queue Depth Drift (AQDD), and the agent's Human Escalation Rate (HER) trend. If any check fails, the agent must escalate to humans rather than act. The post links this pattern to earlier observability concepts (DQR, TIE, HER, AQDD, ARO, RTD, CUR), provides a Python reference implementation (MIT license) on GitHub, and recommends adding agent pre-action state fields to postmortem templates. The proposal is intended as infrastructure to make agentic automation safer in production systems.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.