Nuggets, a London-based identity and trust technology company, has launched what it calls the Authority Control Plane (ACP), a governance layer designed to sit in the execution path between autonomous AI agents and the enterprise systems they interact with. The product is available now.
The core proposition is a distinction the company draws between access and authority. Existing identity and access management infrastructure can verify who an agent is and record what it did, but Nuggets argues it cannot confirm whether each specific action was authorised at the moment it was attempted. The ACP is positioned to close that gap by evaluating verified identity, delegated authority, organisational policy and runtime context before any agent action is executed.
What the product does
Administrators using the ACP can define the scope of what an agent may do, including the systems it can reach, spending thresholds, approval triggers and expiry conditions on delegated authority. Authority can be issued, delegated and revoked in real time, and the company says an estate-wide kill switch can suspend all agent authority simultaneously, failing closed rather than open.
Each enforcement decision produces what Nuggets calls an Action Receipt, described as a portable cryptographic record showing who acted, under whose authority, what was requested, which policies were evaluated and why the action was permitted, denied or referred for human approval. The company says the receipt travels with the action beyond organisational boundaries, allowing customers, partners, auditors and regulators to verify it independently without exposing underlying data.
An open-source integration with the LangChain agent framework demonstrates the enforcement behaviour in practice. Nuggets says that revoking an agent’s authority causes the very next attempted action to be blocked at execution, not flagged after the fact in a log review.
Seema Khinda Johnson, co-founder and chief commercial officer of Nuggets, explained the commercial motivation behind the launch: “Customers told us they can’t move agents to production, because they can’t prove what an agent was allowed to do. That’s why we built the Authority Control Plane: to set what agents can do, enforce it as they act, and prove it to anyone who asks.”
Regulatory and market context
The launch arrives as enterprise AI deployment accelerates into territory that regulators in multiple jurisdictions are actively trying to frame. In the EU, the AI Act’s obligations around high-risk systems place a clear requirement on operators to maintain meaningful human oversight and auditability of automated decisions. In financial services specifically, DORA’s operational resilience requirements and existing FCA guidance on algorithmic accountability both point toward the kind of runtime audit trail the ACP is designed to produce.
The market for AI governance tooling is broadening rapidly. Established identity providers including larger IAM and privileged access management vendors are extending their platforms toward agent governance, while a cohort of specialist startups are building purpose-built layers for agentic workflows. Nuggets positions the ACP as complementary to existing IAM and PAM infrastructure rather than a replacement, which reduces the sales friction but also means the company must prove additive value in environments where the incumbent vendor may ship a similar capability.
The commercial traction and pricing model for the ACP were not disclosed in the announcement. The markers to watch are named enterprise customers in regulated sectors, the depth of integration with major cloud and enterprise stacks beyond LangChain, and whether the cryptographic audit receipt achieves the kind of regulator recognition that would make it a de facto standard rather than a proprietary artefact.
The post Nuggets Launches Authority Control Plane for Autonomous AI Agents appeared first on The Fintech Times.
