Village Gateway

An AI agent asks. Your rules decide. The decision is a signed record you can check offline.

Village Gateway is built and deployed on both production hosts as an access and approval layer: an agent or person's request to act is checked against the Village's policy, a decision is recorded with a signed receipt, an approval-gated request waits for a different approver, and an allowed request gets a one-use permit that a resource redeems exactly once.

Where it stands: built, deployed on our production servers and reviewed by AI agents. It is switched on in one Village, the one we use for testing, where a full decision has run through it from request to checked record. No customer has used it yet, and it is available to evaluate by invitation.

Check a record yourself See the price How to get it

What it does

Four things, in the order they happen to a request.

It checks the request against your policy

When an AI agent or a person asks to act, the request is checked against the policy of the Village before anything happens, and the answer is allow, hold for approval, or deny.

Policies are organised by category. The server works out the category from the action, and a policy folds deny over hold over allow.
Policy versions cannot be changed once made. A new version is activated in one step.
A decision is checked again when it is approved and again when its one-use permit is issued, if the policy changed in between.

It waits for a different person to approve

A request that needs approval waits for an approver. The person who asked cannot be the one who approves.

The approval is recorded with who gave it and when.
A request that is not approved in time expires, and the expiry is recorded.

It gives an allowed request a one-use permit

An allowed request receives a permit that the protected system redeems exactly once. A second attempt with the same permit is refused.

A reference resource shows how a protected system redeems a Gateway permit over HTTP: an allowed request executes exactly once, an approval-gated request waits and executes once after approval, and the resource reports the outcome back to the record.

It records every decision

Each decision is recorded with a signed receipt. The record can be exported with its approvals, receipt and events.

The receipt names the key that signed it.
The export can be checked away from the product, by anyone, with the checking program below.

For AI agents, and for the people who answer for them

Agents reach it through MCP

An AI agent can reach Village Gateway through an MCP adapter with three tools: ask for a decision, read a decision, and take a permit for an allowed decision.

Policy by category

Policies are organised by category: the server resolves a category from the action, a policy profile folds deny over gate over allow, versions are immutable and activated atomically, and a decision is re-checked at approval and at permit if the profile changed. Four seed categories ship as templates.

A Village administrator creates and activates policy versions through the routes the product provides.
Four starting templates ship, for an operator to install: machine intelligence and automation; financial records and transactions; governance decisions and communications; provenance and supply-chain evidence.

Check a record yourself

The checking program is one JavaScript file you can read. It needs Node.js version 20 or newer, opens no network connection and needs no product installed.

A decision record can be exported with its approvals, receipt and events, and an offline checker (Node 20, no network, no product installed) verifies the export against a bundle of public keys.

Village Gateway sends every receipt it signs to an outside time-stamping authority (Certum), and the checking program verifies the RFC 3161 stamp offline when an export carries one; on 4 Nov 2026 a decision in the Village the operator uses for testing was held, approved with a step-up sign-in, given a one-use permit and exported, and the checking program returned verified, including the Certum stamp.

Download the checking program Sample exported record Sample bundle of public keys

SHA-256 of the checking program, as this site serves it:

837af35cba4bfa3b971c51d0203942f9ee6e98003c74ed06692907a7599198d4

node gateway-evidence-verifier.js gateway-export-sample.json --bundle gateway-trust-bundle-sample.json

The two samples are synthetic: a throw-away key and invented values. Run on the sample, the checking program exits with 1, by design. The sample export was made before any outside time stamp had been obtained for its signed receipt, so the checking program reports the time-stamp check as incomplete, and a mandatory check that cannot be made is a failure. When an export carries a stamp, the checking program checks it offline. Exit codes: 0 every mandatory check passed; 1 a check failed or could not be made; 2 a usage error or an unreadable file; 3 a version this copy does not know.

That the signed receipt and the exported record carry valid signatures from a key in the bundle of public keys you hold, and, where the bundle states a validity period, that the key was valid when the decision was made.
That the approvals and the events agree with the decision's final state, and that a decision does not show a state its events do not reach.
That the checking program is the file described here: compare its SHA-256 with the value above.

Publishing the checking program is for reading and checking. It is not a licence to anything.

What it does not do

It is switched on in one Village, the one we use for testing. No customer has it switched on. The platform switch is on for only one of our two servers, and each Village's own setting must be on as well: only our test Village's is.
Receipts are signed under keys that My Digital Sovereignty Ltd holds. It is not yet connected to the Governance API verdicts.
It was built and reviewed by AI agents, and has not been audited by a person.
The reference resource is a reference. It is not a connector to your systems, and no customer resource is connected.
The checking program shows that a record is unchanged since it was signed and agrees with itself. It does not show that the action then happened. An export taken before the outside time stamp has arrived reads as incomplete, and the checking program checks the stamp whenever an export carries one.
No category is installed on any Village yet, and a Village administrator works through routes, as there are no screens yet.

How to get it

Village Gateway is a managed service, priced per category. Evaluation access starts from a one-time link we issue at our discretion. There is no self-service signup.

Ask for evaluation access See the price

Direction

MDSL intends to release Village Gateway as open source. This is an intention only: nothing has been released, no licence has been fixed, no date is set and no stage has been named.

Who made it

Built by AI agents under John Stroh's direction, and reviewed by AI agents.

No person has audited this software.

Prepared by AI agents working under John Stroh's direction. No person has audited this page.

Publisher: My Digital Sovereignty Ltd, Amberley, New Zealand.

Ask about Village Gateway

Evaluation access is by invitation: a one-time link, issued at our discretion.

Check a record yourself, offline, with no account needed.