Capability Gateway

The governed front door between the public internet and the capability mesh. A form submission, an API call, an agent request — each becomes a single, narrow, policy-checked capability invocation, and nothing else can reach the systems behind it.

• A scoped actor token can invoke only the capabilities it is granted — never an arbitrary write.
• Every request is evaluated by deterministic policy before it runs; approvals gate the sensitive ones.
• The record is created on the node that holds the credentials, then projected out — no central store of secrets.
• Every invocation appends to a tamper-evident audit trail and returns a signed receipt.