Business Decisions. Technical Enforcement.
Zero Gap.
When a contract expires, a budget is exceeded, or a vendor becomes non-compliant, AuthHub enforces the decision at the authorization boundary in under 100ms. Not next quarter. Not after a ticket. Now.
The Problem
When your CFO flags a budget breach, it takes days to become a technical reality. Someone raises a ticket. IT processes it. The access is manually revoked. Meanwhile, the AI agent keeps spending. When Legal flags a vendor contract as expired, the same chain fires. The same gap exists.
We measured this gap precisely: 200 milliseconds with a standard single-check authorization pattern. Enough time for an AI agent to dispatch a consequential action on stale permissions.
How Governance Signals Work
External business systems (FinOps, Legal, Procurement, Security) send governance signals to AuthHub. AuthHub evaluates the signal against configurable policies and applies enforcement in real-time. Connected agents receive enforcement events instantly via WebSocket push.
Three Delivery Modes
Choose the enforcement delivery mode that fits your agent architecture.
Agent opens a WebSocket to AuthHub and subscribes. Receives REVOKE events in real-time the instant enforcement activates. Zero polling. Zero gap.
Agent calls CheckPermission before preparation AND before execution. Signal arriving during preparation is caught at the second check. Stateless. No persistent connection needed.
Agent calls CheckPermissionHold with a hold window (e.g., 200ms). AuthHub evaluates immediately. If PERMIT, holds the connection. If enforcement arrives during the window, returns DENY instantly. No WebSocket required.
Measured Results
Independently validated from Oracle Cloud Infrastructure (London) calling AuthHub over the public internet. Real TLS. Real network latency. Real race conditions.
| Pattern | Gap | Prevented? | Network Calls |
|---|---|---|---|
| Single pre-flight | 200ms | NO | 0 during prep |
| Double-check | ~30ms | YES | 1 (second check) |
| Continuous polling | ~15ms | YES | N (repeated polls) |
| WebSocket push | 0ms | YES | 0 (push-based) |
Tested 19 August 2026. Oracle Cloud Infrastructure London → api.authhub.cloud. 11 scenarios, 8 Phase 1 + 5 Phase 2 tests. Evidence assessment: SUFFICIENT (5/5 criteria).
Signal Types
AuthHub accepts governance signals from any external system. Each signal type maps to configurable enforcement policies with proportional response.
FinOps system detects spend at 80% → require attestation. At 100% → throttle. At 150% → suspend.
Legal/CLM flags vendor contract expired or non-compliant. Affected agents suspended. Unaffected agents continue.
Security feed reports CVE with CVSS 9.8 affecting a component. All agents using that component suspended pending patch.
ITSM/ROI system flags AI pilot as expired without proven value. Agent downgraded from production to sandbox scope.
Custom signal types supported. Any external system can send signals via the REST API with configurable policy-to-enforcement mappings per tenant.
Full Evidence Chain
Every enforcement decision carries a complete provenance trail. One trace ID correlates across all layers — from signal ingestion through to the agent receiving the REVOKE event.
Architecture
Use Cases
Data Center Cooling Control
AI optimizer adjusts physical cooling actuators. Vendor contract expires. Governance signal suspends the agent before the next actuator command fires. Measured: REVOKE delivered in 49ms over public internet.
Clinical AI Budget Enforcement
NHS trust runs 4 clinical AI agents on a shared budget. FinOps detects 120% spend. AuthHub throttles to 10% rate, downgrades model tier from GPT-4o to GPT-4o-mini. Decision owner notified via Slack.
Autonomous Trading Compliance
Regulatory signal: new trading restriction effective immediately. All agents with exposure to the affected instrument suspended within 100ms. Audit trail proves enforcement preceded the next trade.
Supply Chain Vendor Risk
Procurement system detects vendor non-compliance (missing insurance, failed audit). All AI agents using that vendor's APIs suspended. Other vendors unaffected. Proportional, not binary.
Try the Governance Signal Pipeline
See the enforcement pipeline in action with the interactive demo, or explore the API documentation.
Results from independent execution-boundary validation, 19 August 2026. Oracle Cloud Infrastructure (London) → api.authhub.cloud. Public internet. TLS 1.3.