WhiteFin

WhiteFin is an authority management platform for autonomous AI systems. It addresses the gap between what an AI agent technically has permission to do (via credentials/IAM) and what an organization has explicitly authorized it to do for a given task.

Core problem addressed:

• AI agents can hold valid credentials that permit far more than the intended scope of a task
• Existing controls (IAM, gateways, runtime security, observability) do not answer whether a specific action was within the power the organization meant to delegate
• Organizations are forced to choose between human approval bottlenecks or overly broad permissions

What WhiteFin does:

• Observe: Discovers autonomous execution activity on supported Linux infrastructure without requiring agent rewrites or instrumentation
• Authority: Translates organizational intent into explicit, bounded authority scopes; resolves them against known capabilities and routes only meaningful decisions to approvers
• Enforce: Applies committed authority through deterministic, inline controls at supported execution boundaries at machine speed
• Proof: Produces cryptographically protected evidence linking the active authority, the approval decision, and the resulting effect or prevented effect
• Learn: Improves future authority boundaries from verified execution data

Key design properties:

• Authority is bounded rather than inferred from broad credential capability
• The autonomous system cannot authorize itself
• Evidence can be independently verified without trusting the enforcing system
• Critical operations can run inside the customer environment without depending on vendor cloud availability