Village Gateway

An AI agent asks. Your rules decide. The decision is a signed record you can check offline.

For example: an AI agent asks to pay a supplier. Village Gateway holds the request until a second person approves it. Village Gateway then signs the decision, and the agent receives a permit that works once.

An agent or person's request to act is checked against the Village's policy.
A decision is recorded with a signed receipt.
An approval-gated request waits for a different approver, and an allowed request gets a one-use permit that a resource redeems exactly once.

Where it stands: built and deployed on our production servers.

A full decision has run through it from request to checked record.

Village Gateway is built and deployed on both production hosts as an access and approval layer: an agent or person's request to act is checked against the Village's policy, a decision is recorded with a signed receipt, an approval-gated request waits for a different approver, and an allowed request gets a one-use permit that a resource redeems exactly once.

How it works See the price How to get it

What it does

Four things, in the order they happen to a request.

It checks the request against your policy

When an AI agent or a person asks to act, the request is checked against the policy of the Village before anything happens, and the answer is allow, hold for approval, or deny.

Policies are organised by category. The server works out the category from the action, and a policy folds deny over hold over allow.
Policy versions cannot be changed once made. A new version is activated in one step.
A decision is checked again when it is approved and again when its one-use permit is issued, if the policy changed in between.

It waits for a different person to approve

A request that needs approval waits for an approver: the Village owner or a moderator, who confirms who they are before approving. The person who owns the key that made the request cannot approve it.

The approval is recorded with who gave it and when.
A request that is not approved in time expires, and the expiry is recorded.

It gives an allowed request a one-use permit

An allowed request receives a permit that the protected system redeems exactly once. A second attempt with the same permit is refused.

A reference resource shows how a protected system redeems a Gateway permit over HTTP: an allowed request executes exactly once, an approval-gated request waits and executes once after approval, and the resource reports the outcome back to the record.

It records every decision

Each decision is recorded with a signed receipt. The record can be exported with its approvals, receipt and events.

The receipt names the key that signed it.
The export can be checked away from the product, by whoever holds the export, with the checking program on the technical page.

What sets it apart

The record does not rest on our word alone. Three things tie each decision to evidence a reader can check.

Sealed daily, with anchoring on Midnight built in

Daily sealing is built. Where a Village hosted in the EU has turned it on, each day's decisions are sealed into a day root for the Village. That root joins the platform's daily estate root. Anchoring a hash of the estate root record on Midnight mainnet is built; it does not run on mainnet yet, and the anchors in the published index so far are on Midnight's Preview network. A reader with the export and an anchor proof from the Village, plus a ledger reading, can show that the record was fixed by that day.

No request or decision content leaves the Village. Where anchoring is turned on for a Village hosted in the EU, only a hash of the daily estate root record goes to Midnight, never content.
The checking program can check an anchor reading that you supply.

Signed with the identity of the Village

Every receipt names the decentralised identifier (DID) of the Village and the key that signed it. The public keys travel in a trust bundle that the Village supplies, and the checking program takes that bundle as its input.

The receipt and the exported record each carry an Ed25519 signature.
The checking program verifies both against the trust bundle, with no network.

Time-stamped by an outside authority

Each receipt is sent to Certum in Poland, an outside time-stamping authority, for an RFC 3161 time stamp. Where one is returned, the checking program verifies it offline, so the time of a decision does not rest on our clock alone; until it arrives, the export shows the stamp as pending.

The checking program holds the keys of four European time-stamping authorities fixed (Certum, BOSA, CESNET and the Portuguese state's Cartão de Cidadão authority) and verifies a stamp from any of them.

A second, post-quantum signature (ML-DSA-65, FIPS 204) is built into several Village record kinds and turned on per account. Next, it will be added to Gateway receipts, and each receipt will be sent to more than one time-stamping authority.

For AI agents, and for the people who answer for them

Agents reach it through MCP

An AI agent can reach Village Gateway through an MCP adapter with three tools: ask for a decision, read a decision, and take a permit for an allowed decision.

Policy by category

Policies are organised by category: the server resolves a category from the action, a policy profile folds deny over gate over allow, versions are immutable and activated atomically, and a decision is re-checked at approval and at permit if the profile changed. Four seed categories ship as templates.

The Village owner creates and activates policy versions through the routes the product provides.
Four starting templates ship, for an operator to install: machine intelligence and automation; financial records and transactions; governance decisions and communications; provenance and supply-chain evidence.

Proof you can check

Every decision leaves a signed record, and each receipt is sent to an outside time-stamping authority for a time stamp.

Anyone you give the record to can check it with the checking program, using the trust bundle the Village supplies and Node 20 or newer. It needs no account and no network.

Technical details and the checking program

What Village Gateway controls

An AI agent asks Village Gateway before an important action. Your rules decide. The decision is a signed record you can check offline, and an approved action gets a single-use permit for exactly that action. The Village owner can stop every Gateway decision and permit for every AI agent at once, set a spending limit for each agent key, and see counts of what was checked over any period.

Putting Village Gateway in the path of an action takes four steps. The agent describes what it wants to do, and Village Gateway answers: go ahead, wait for approval, or no. A cleared action receives a permit made for exactly that action. The system that carries out the action checks the permit with Village Gateway before it acts, and each permit works once. The outcome is reported back and joins the record. Because the system that does the work asks for the permit, nothing it does goes ahead without a decision from Village Gateway. A small reference program, built and tested, shows the whole route and is available on request.

MIO° Conduct Record is the sealed register of which AI agents an organisation runs and what each is authorised to do, available on request. The register records authority and does not block anything. Village Gateway can check any request it governs against the mandate in force for the agent, where a policy asks for it: the action, the resource, the amount and the time window must fall within the mandate, or the request is denied. The Email Decision Record has a narrower check for sending email, which compares the action's name only. Both checks are built. Each one stays off until the operator turns it on.

About MIO° Conduct Record →

Connecting it to your systems

Connecting it is straightforward: the system that carries out an action checks for a Village Gateway permit before it acts. Our small reference program, built and tested, shows the whole route, and it is available on request.
Each receipt is signed under keys held by My Digital Sovereignty Ltd, and the receipt names the Village and the key that signed it.
The checking program shows that a record is unchanged since it was signed and agrees with itself, and it checks the outside time stamp whenever an export carries one. An export taken before the stamp has arrived shows the stamp as pending.

Questions and answers

What a new Village owner usually asks first.

What is a category?

A category is a kind of action that Village Gateway governs, and your Village policy is organised by category. The server works out the category from the action. When the Village owner confirms their email address, Village Gateway is turned on with four starting categories: machine intelligence and automation; financial records and transactions; governance decisions and communications; provenance and supply-chain evidence. The price is per category.

What is the evaluation, and when is my card charged?

The evaluation is a 30-day trial that starts when you open the one-time link we send you. During the trial the Village owner adds a payment card on the Village Gateway card page and chooses between one and four categories, monthly or annual. The card is checked then and nothing is charged. The first charge is on the day the trial ends, unless you cancel before then.

How much does it cost?

The price is per category, monthly or annual, in New Zealand dollars, and no GST is added. Each category has the same price, so four categories cost four times as much as one. The amounts are on the pricing page.

How do I cancel, and what access remains?

The Village owner cancels on the card page. If you cancel during the trial, nothing is charged and you can keep using Village Gateway until the trial end date. A monthly subscription cancelled after the trial runs to the end of the month you have paid for. If you cancel an annual subscription after the trial, it stops on the day you cancel, and the unused whole months are refunded as the pricing page explains.

Who can approve a held request, and why a different person?

The Village owner or a moderator can approve (an older administrator role counts as a moderator), and each approval asks them to confirm who they are. The person who owns the key that made the request can never approve it, so nobody can both ask for an action and approve it. When an authority needs more than one approver, the request waits until enough different people have approved.

What happens to a request nobody approves?

A held request waits for up to 24 hours. After that the request has expired: nobody can approve it, the agent cannot take a permit for it, and the expiry is recorded in its history.

What is a permit?

When a request is allowed, or approved, the agent can ask for a one-use permit. The system the agent wants to act on redeems the permit once, and a second attempt with the same permit is refused. A permit lasts five minutes and never outlasts the decision it belongs to.

How do I check a record?

Every decision can be exported as a record. Anyone you give it to can check it with the checking program, using the trust bundle the Village supplies and Node 20 or newer; it needs no account and no network. The program, the published SHA-256 value to compare it with, and the steps are on the technical page.

What does an AI agent need?

Two things: a connection over MCP to your Village's Gateway address, and a Gateway key that the Village owner creates on the approvals page. The owner then gives the key an authority, which says what it may ask for. Through MCP the agent can ask for a decision, read a decision and take a permit; it cannot approve anything.

How do I get evaluation access?

Ask on the evaluation request page. Each link works once and is issued at our discretion; there is no self-service signup. The link takes you to the page where you create your Village, and Village Gateway is turned on when you confirm your email address.

Where is the data held?

The Village created for your evaluation is hosted in the EU (France). Card payments are handled by Airwallex (NZ) Limited: your card details go straight to Airwallex, and our pages never see them.

What happens if my card is declined?

If your bank declines the charge at the end of the trial, or a renewal charge, the categories that subscription pays for stop working: the agent cannot take new permits for them. Write to us and we will help you put it right.

What is built, and what is not?

Everything this page describes as what Village Gateway does is built and deployed on our production servers. Sealing Gateway decisions into the daily estate root has been built for Villages hosted in the EU, and the owner of each decides whether it is turned on; anchoring a hash of the estate root record on Midnight mainnet is built and does not run on mainnet yet. Nothing has been released as open source. It was built and reviewed by AI agents, and no person has audited it.

How do I get help?

Start with the step-by-step guide, which walks a new Village owner through every screen. For anything else, write to support@mysovereignty.digital or use the contact page.

Read the step-by-step guide Contact us

How to get it

Village Gateway is a managed service, priced per category. Evaluation access starts from a one-time link we issue.

When the owner of a new Village for evaluation confirms their email address, Gateway is turned on in that Village and four starting categories are installed. The categories the owner chooses when adding a payment card then work. Unless the owner cancels first, from day 30 the card is charged the per-category price for each category chosen, monthly or annual. The Village owner sets up categories and policies through the Village's API; approvals, keys, limits, alerts and checks have their own pages.

Ask for evaluation access Read the step-by-step guide See the price

Direction

MDSL intends to release Village Gateway as open source. This is an intention only: nothing has been released, no licence has been fixed, no date is set and no stage has been named.

Who made it

Prepared by AI agents working under John Stroh's direction.

Publisher: My Digital Sovereignty Ltd, Amberley, New Zealand.

Ask about Village Gateway

Evaluation access is by invitation.

Check a record yourself, offline, with no account needed.