The Agent Has Authority. Nuggets Wants Proof of Who Gave It.

Nuggets announced the Authority Control Plane on 22 July 2026. Moona Intelligence is verifying it a month later, against Nuggets' own documentation, its own public code, and the distinction this record exists to hold onto: the difference between proving an action was allowed and proving who was actually entitled to allow it.

That distinction matters because most of what Nuggets claims for the first half is genuinely well specified. Most of what would be needed for the second half is not addressed by Nuggets' own material at all, and this record says so explicitly rather than rounding an identity claim up into a legitimacy claim.

What Nuggets says it built, and where it sits

Nuggets describes the Authority Control Plane as an enterprise platform for defining, delegating, enforcing and proving what autonomous AI agents are authorized to do, positioned in the execution path between an agent and the applications, tools and enterprise infrastructure it interacts with. When an agent attempts an action, Nuggets says the platform evaluates that agent's verified identity, its delegated authority, the organization's policy, the intent behind the action and the runtime context, before permitting the action, denying it, or referring it for human approval. Every decision, Nuggets says, produces a signed Action Receipt recording who acted, under whose authority, what was requested, which policies were evaluated, and why the action was permitted, denied or referred.

This did not appear from nothing. Nuggets shipped AI agent authentication products in late 2024, and in April 2026 its research arm, publishing as Nuggets Labs, released an Enterprise AI Governance Framework naming a trust stack of Identity, Authority, Intent and Action and a new control layer it called Action Governance, sitting between access and execution. The Authority Control Plane reads as the shipped platform version of that same framework three months later, which is worth knowing because it means the July launch is not a company discovering this problem for the first time. It is a company productizing an argument it had already published.

What existing infrastructure already answers, and what Nuggets says it adds

Nuggets is direct about not replacing an organization's identity and access tooling. Its own positioning is that IAM, PAM and cloud security infrastructure already establish who an agent is, what it can reach, and what happened, and that the Authority Control Plane sits on top of that stack rather than in place of it, adding a layer that decides whether one specific proposed action is authorized at the moment it is attempted. That is a clean version of an argument this desk has made independently, most directly in Moona Intelligence's own reading of why instructions and standing permissions cannot substitute for a check performed at execution time. Nuggets arriving at the same architectural conclusion from a different starting point, agent identity and delegation rather than a coding framework's zero trust reference design, is evidence the market is converging on the same boundary from more than one direction.

What Nuggets' available material does not specify is the mechanics of that layering. Whether the Authority Control Plane's decision is an intersection with whatever IAM or PAM already grants, the way GitLab's composite identity explicitly narrows to the more restrictive of a human role and a service account role, or whether it is an additive check that runs alongside existing access control without formally bounding it to the narrower of the two, is not documented in what Moona Intelligence could read. Nuggets says it works across existing IAM, PAM and cloud infrastructure. It does not say, in the material available to this record, that its own authorization is capped at whatever that infrastructure already permits.

Five inputs, and only some of them are a lookup

Nuggets names five things the platform checks before an action proceeds: verified identity, delegated authority, organizational policy, intent and runtime context. Three of those read as deterministic in the ordinary sense: identity, authority and policy are the kind of question a system answers by consulting a stored record, the same way a permission check consults an access control list. Runtime context, the state of the environment at the moment of the call, is also a fact the system can observe directly.

Intent is not the same kind of input, and this record is careful not to blur it into the other four. Deciding whether a proposed action matches what a person actually meant is an interpretive judgment, not a lookup, and Nuggets' own material, as available to Moona Intelligence, does not specify what produces that judgment, whether it is a deterministic rule set or a probabilistic classifier, or how the system prevents an intent assessment from becoming the deciding vote while being described as one signal among five. That is precisely the caution Rubrik's own architecture makes explicit for a similar semantic check, where a small language model's read of intent is documented as enrichment for a separate, deterministic policy decision rather than the decision itself. Nuggets does not document that separation as clearly, so this record does not credit it to Nuggets' design, and instead flags it as an open question a strict reading of the architecture has to leave open.

What administrators can configure, and what happens when they revoke it

Nuggets documents specific, checkable administrative controls: which actions an agent may perform, which systems it may reach, operational limits including spending thresholds, requirements for human approval, and an expiry on the authority itself. Those are the same dimensions this desk has already argued any real delegation has to specify, named here by a vendor shipping a product against them rather than by a population level survey.

On revocation, Nuggets' own account is that withdrawing a delegation takes effect immediately, with the agent stopped at its next attempted call rather than only at its next scheduled check. That is a specific claim, and it is at least consistent with what Moona Intelligence could independently confirm in Nuggets' public langchain nuggets integration, covered in detail below: the client middleware calls Nuggets' authority endpoint before every tool call, not once when a session opens, so a revoked delegation has a genuine, per call opportunity to be caught rather than a stale permission sitting in memory until something else refreshes it. Nuggets' own description of the platform also includes an organization wide control able to suspend agent authority across an entire estate at once, separate from revoking one delegation. Moona Intelligence was not able to independently locate a first party technical description of that control's exact scope or mechanics beyond how Nuggets characterizes it, so it is recorded here as Nuggets' own claim rather than as independently verified behavior.

Where authority is proven to come from, and where it is not

This is the distinction this record exists to hold apart from ordinary enforcement, and it is worth stating precisely. Nuggets documents that an agent's identity is cryptographically linked to a specific human and organization, and that authority in Nuggets' model traces back to an explicit grant from that person or organization. That is real, and it is more than most agent platforms document about where an agent's authority originates.

The same gap runs through three related questions. Nuggets does not document, in material available to this record, a formal channel by which someone other than the original grantor, an auditor, a resource owner, a regulator, a second approver, can challenge or invalidate a delegation already in force. It does not document a rollback, compensation or dispute path for a consequential action a since revoked or since disputed authority already completed; a kill switch prevents the next action, it does not undo the last one. And while Nuggets documents that authority can be layered on top of an organization's existing IAM and PAM, it does not document, in what this record could read, whether that layering is bounded to the intersection of what those systems already grant or is an additive check running alongside them. All three are recorded here as undocumented rather than as failures, because Nuggets has not claimed to have solved them. The distinction matters precisely because the launch material's own strongest claim, that an agent's authority traces to a specific human, is easy to over read as though it also proved that person's standing to grant it. It does not, and this record does not let the one imply the other.

What the Action Receipt actually proves

Nuggets describes every decision as producing a signed Action Receipt, portable evidence recording who acted, under whose authority, what was requested, which policies were evaluated, and why the action was permitted, denied or referred, verifiable by customers, partners, auditors and regulators without access to Nuggets' internal logs. Moona Intelligence read this claim against langchain nuggets, Nuggets' own public LangChain and LangGraph integration, rather than against marketing language alone.

What is independently verified there is specific and real. The package's documentation, read directly from its repository, describes the receipt as binding an RS256 signed proof to the agent's key and a decentralized identifier, computing a versioned action context hash, using RFC 8785 canonical JSON serialization and domain separated SHA-256, over the tool, target, parameters, and, where present, intent and payment fields, together with the agent, controller and delegation identifiers. Its own changelog documents that hash binding, along with strict issuer pinning against a discovered and cached key set, a fixed signing algorithm allowlist, and a fail closed default on any verification failure, being added and hardened across successive releases rather than claimed complete from the first version. Parameters and results are hashed rather than carried in the clear, so a receipt can be verified without exposing the underlying data to whoever holds it. Verification depends on a key Nuggets publishes and a party can check independently, without calling Nuggets' live service for every receipt.

What that same public code cannot show is what happens on the other side of the endpoint it calls. The decision service that actually evaluates identity, authority, policy and intent is not open source, so nothing this record read independently confirms that a specific policy was evaluated correctly, that the backend's own key handling matches what the client library assumes, or that the receipt's contents accurately reflect a real evaluation rather than a response the backend is trusted to have produced honestly. The wire format and the client's enforcement posture are verified. The correctness of what actually happens behind Nuggets' authority endpoint is Nuggets' own account of its own system, the same caution this desk applies to every vendor claiming enforcement it does not open to inspection.

The one piece that is genuinely inspectable

langchain nuggets is a real artifact, not a description of one. Moona Intelligence read its README, its changelog and its security policy directly from the NuggetsLtd GitHub organization. It ships as two feature parity software development kits, one in Python and one in TypeScript, under the MIT license, wrapping LangChain and LangGraph tool nodes so that a proposed tool call is checked against Nuggets' authority endpoint before it runs, and the call does not execute when that check cannot be completed. A tests directory exists inside the Python package, alongside a conftest file and separate suites for the middleware and for LangGraph specific behavior; this record confirms the suite exists as a directory listing, not that its assertions were read line by line or that it was executed.

The project's own changelog reads as the kind of candor this desk treats as a positive signal rather than a marketing document: successive versions add mandatory audience bound token verification, remove support for opaque tokens in favor of a signed format only, pin a fixed signature algorithm, and make previously soft failure paths fail closed by default. That is a team hardening a real, running integration against real gaps over time, the same pattern Moona Intelligence has read as engineering seriousness in other public reference implementations this year. It carries the same limits those did too. At the time this record was verified the repository showed zero stars and zero forks, consistent with a vendor published integration nobody outside Nuggets has yet adopted, and its security policy names response time commitments for vulnerability reports without addressing revocation propagation latency or kill switch scope, which remain undocumented by the same source that documents everything else about this package in detail.

What remains a claim, stated as one

Nuggets says Tier 1 global enterprises are standardizing on its infrastructure for multi cloud AI deployments. No named customer, case study or independently reported deployment accompanies that claim in any material available to this record, and it is recorded here as a vendor claim about its own adoption, not as independently verified production use. The same caution applies to the platform's core enforcement claim taken as a whole: what is documented is a specific, checkable architecture and, in langchain nuggets, a real client side implementation of part of it. What is not documented, because Nuggets has not published it, is independent evidence that the backend deciding these questions behaves as described at the scale and under the adversarial pressure a live enterprise deployment applies.

Is Agent Authority actually becoming its own category

Nuggets' own language, an Authority Control Plane sitting between agents and the systems they touch, reads as though it is naming something new. Verified against independent research rather than against Nuggets' own framing, the picture is more specific than that, and less generous to a first mover reading.

Forrester recognized agent control plane as an emerging market category in December 2025, seven months before Nuggets' launch, describing it as a third functional plane, alongside a build plane and an orchestration plane, that inventories, governs, orchestrates and assures heterogeneous agents across vendors and domains. Forrester followed up in March 2026 with a survey of forty seven technology vendors it reports found seventy nine percent already recognizing agent control planes as a meaningful, distinct product category, ninety two percent with a named product manager or team against it, and forty percent seeing active buyer demand naming a control plane specifically. Both figures come from Forrester's own published research, read through independently phrased search passes rather than a direct fetch, forrester.com being blocked to automated fetching in this session's tooling environment, and are recorded as documented research rather than as independently reproduced survey data.

That matters for exactly the claim this record is careful not to make. Nuggets is not naming a standalone category from a standing start. A broader agent control plane category, covering governance, orchestration and assurance generically, already existed and was already being tracked by industry analysts well before this launch. What Nuggets is doing inside that broader space is narrower and more specific: arguing that authority, whether one particular attempted action is authorized right now, is a distinct question from identity and from access, and deserves its own enforcement point rather than being folded into either. That narrower separation is where this record finds genuine, multi vendor convergence, not in Nuggets' own choice of name. GitLab's composite identity and Rubrik's Agent Identity, both already covered independently in Moona Intelligence's own agent authority coverage, arrive at variants of the same identity, access, authority separation from different starting points, and neither uses Nuggets' vocabulary to get there. Nuggets should be read as one participant in that convergence, verified on its own merits above, not as the company that invented the distinction.

Why this is its own record

TrueFoundry's MCP Gateway already owns where a held call sits at a shared enforcement boundary. GitLab's composite identity already owns how a human and an agent identity intersect inside one authorization decision. Rubrik's Agent Identity already owns minting a credential scoped to one specific call after that call is already known. None of them, on their own published material, join delegation, revocation, an execution time check and portable signed evidence into one claimed architecture the way Nuggets does, and none of them makes a claim, however incompletely documented, about where the authority traces back to in the first place. That combination, not any single piece of it, is why Nuggets gets its own record rather than an update folded into an existing one. What this record adds to this desk's earlier argument that delegated authority needs a defined boundary and to its separate argument that after the fact evidence has to reconstruct more than a plain event log is a single vendor attempting both at once, verified as far as its own public material and public code actually allow, and not one step further.