How Avallo works

This page is for risk and technology reviewers. It sets out the mechanism, how Avallo connects to the systems an agent acts on, what it holds, and the evidence each decision leaves. The short version is on the home page.

On this page
  1. The mechanism
  2. Grant and Warrant
  3. Five steps
  4. Why the check sits outside
  5. Worked example
  6. How Avallo connects
  7. Where it runs and what it holds
  8. Where AI is used
  9. The evidence each decision leaves
  10. The Enterprise AI Control Layer

The mechanism

Accountable people approve a Grant for an agent in advance. The agent proposes a specific action. Avallo checks that action at the moment it would take effect and, if it fits, issues a single-use Warrant that the system acts on once. Every decision is recorded.

How Avallo worksAccountable people approve a Grant for an AI agent: what it may do, with whom, how much and until when. The agent proposes an action; it holds no reusable credentials, and the system acts only on a valid Warrant. Avallo, which sits between the agent and the system, checks the action against the Grant at the moment it would take effect. If it fits, Avallo issues a single-use Warrant and the system acts once. If it needs approval, it is escalated to a named approver. If it does not fit, it is refused and nothing happens. Every decision is recorded as evidence. Accountable peopleApprove the Grant for each agentAI agentProposes an action, suchas paying a supplierNo reusable credentialsThe system it acts onPayments, records,approvals, IT changesActs only on a Warrant3CHECKAvalloChecks the action againstthe Grant at the moment itwould take effectAllowEscalateRefuseEvidence recordWho authorised what, and why1Grantwhat, with whom,how much, until whenEscalatea named approverconfirms2Proposes an actionRefused:nothing happens4Single-use WarrantSpent as the actiontakes effect5RecordedHow Avallo worksAccountable people approve a Grant for an AI agent: what it may do, with whom, how much and until when. The agent proposes an action; it holds no reusable credentials, and the system acts only on a valid Warrant. Avallo, which sits between the agent and the system, checks the action against the Grant at the moment it would take effect. If it fits, Avallo issues a single-use Warrant and the system acts once. If it needs approval, it is escalated to a named approver. If it does not fit, it is refused and nothing happens. Every decision is recorded as evidence. AccountablepeopleSet the Grant: what,with whom, howmuch, until whenAI agentProposes an action,such as payinga supplierNo reusable credentials1 Grant2 Action3CHECKAvalloChecks each action against the Grantat the moment it would take effectAllowEscalateRefuse4 Warrant5 RecordThe system itacts onActs once, on asingle-use WarrantEvidencerecordEvery decision,independentlyverifiableIf an action needs approval, a namedapprover confirms it. If it does not fit,it is refused and nothing happens.

Avallo lets an organisation:

  1. Define what agents are authorised to do.

  2. Enforce those boundaries at the point of action.

  3. Allow, deny or escalate each action.

  4. Issue a single-use authorisation at the moment of action.

  5. Create independent evidence of what happened and why.

Two terms: Grant and Warrant

Grant
The limits an organisation's accountable people set in advance (which actions, with whom, up to what amounts, for how long, and when a person must approve), confirmed by those people. A Grant never authorises an action by itself, and it never changes silently.
Warrant
A single-use authorisation for one specific proposed action, issued only if that action falls within a Grant, and spent at the moment of commitment.

Five steps for every action

  1. Grant

    Accountable people approve what the agent may do.

  2. Action

    The agent proposes one specific action, such as paying an invoice. It holds no passwords or reusable credentials.

  3. Check

    Avallo checks the action against the Grant at the moment it would take effect.

  4. Warrant

    If it fits, Avallo issues a single-use Warrant and the system acts once. If it needs approval, a named person confirms first; approval does not override the limits. If it does not fit, nothing happens.

  5. Record

    The decision, the rule that applied and who approved it are recorded for independent checking.

Why the check sits outside the agent

An agent can be intelligent and still take an action nobody authorised. Most safeguards today live inside the agent, in its instructions, prompts and training, so the agent is asked to police itself. Prompts and training are instructions an agent can misread, be talked out of, or reason its way around. An agent's instruction is not the control. Authority must be checked outside the agent, where the action takes effect.

Banks can already see the gap. When an agent acts with a customer's own login details, the bank cannot tell an authorised instruction from an agent going beyond it. The bank keeps its identity, payment-limit, fraud and card-network agent controls; the pilot tests whether Avallo's action-specific Warrants add useful control and evidence alongside those measures.

Avallo moves the control outside the agent. The agent proposes an action. The system acts only on a single-use Warrant from Avallo; in a payment deployment, the bank integration must prevent release without a Warrant, and the pilot validates this. No language model makes the runtime authorisation decision: the same proposed action under the same approved limits gets the same answer every time, whatever the agent has been told.

Today

The rules live inside the agent

Today: the rules live inside the agentThe AI agent carries its own rules, such as prompts and training, and acts on the system directly. Problems are often found only after the fact. AI agentIts own rules:prompts, trainingactsdirectlyThe systemit acts onProblems often found only after the fact

Most organisations cope in one of three ways:

  • Human review of every action. It works for exceptions, but it is slow and expensive as the default at scale.
  • Keeping AI to low-risk tasks. Safer, but the high-value workflows stay manual.
  • Monitoring after the fact. The alert arrives after the money has moved or the record has changed.

That is slow, costly and hard to scale.

With Avallo

The rules sit outside the agent

With Avallo: the rules sit outside the agentThe AI agent proposes an action. Avallo, outside the agent, checks it against approved authority before it takes effect. The system acts only on a single-use Warrant. AI agentproposesAvallochecks first,outside theagentThe systemacts onceChecked before it takes effect, with proof

Avallo adds a deterministic check at the point of action:

  • The check happens before the action. It sits in the execution path. Where the system requires a Warrant, the agent cannot skip it.
  • Routine actions need no person. Actions inside approved limits go ahead. Exceptions go to a named approver.
  • The agent holds no reusable credentials. It gets a single-use Warrant for each permitted action. On paths that require a Warrant, an agent that is talked into something has nothing to carry it out with.

Worked example: paying approved suppliers

Bank integration not yet validated. A bank's own AI purchasing agent pays approved suppliers by account-to-account payment. The bank's accountable people approve the supplier, amount, budget and approval rules for the agent, within the bank's own payment limits. Avallo checks each proposed payment against that Grant at the moment it would be released.

Business customers follow later: each sets its own Grant within the bank's outer limits, with decision evidence that may support relevant Scams Prevention Framework controls and AFCA investigations.

What happens to each proposed paymentA bank's own AI purchasing agent proposes a payment: supplier, amount and invoice reference. Avallo checks the payee against the approved supplier list and the payment against the Grant the bank's accountable people approved, within the bank's own payment limits. Within the limits, a single-use Warrant is issued and spent at release, subject to the bank's other payment controls. Above the approval threshold, the named approver confirms, and release still requires the applicable checks and a Warrant. Outside the limits, the payment is refused before any money moves, and the refusal is recorded. THE BANK'S AGENT PROPOSESPay a supplierSupplierAmountInvoice referenceAVALLO CHECKS, BEFORE RELEASEPayee against the approved supplier listAmount and budget against the GrantPayment against the bank's own limitsAmount against the approval thresholdDeterministic: same request, same answerWITHIN THE LIMITSSingle-use Warrant at releaseSpent as the payment is released, subject tothe bank's other payment controls.ABOVE THE APPROVAL THRESHOLDThe named approver confirmsRelease still requires the applicable checksand a Warrant.OUTSIDE THE LIMITSRefused before money movesThe refusal is recorded, with the authorityand rule that applied.What happens to each proposed paymentA bank's own AI purchasing agent proposes a payment: supplier, amount and invoice reference. Avallo checks the payee against the approved supplier list and the payment against the Grant the bank's accountable people approved, within the bank's own payment limits. Within the limits, a single-use Warrant is issued and spent at release, subject to the bank's other payment controls. Above the approval threshold, the named approver confirms, and release still requires the applicable checks and a Warrant. Outside the limits, the payment is refused before any money moves, and the refusal is recorded. THE BANK'S AGENT PROPOSESPay a supplierSupplier, amount andinvoice referenceAVALLO CHECKS, BEFORE RELEASEPayee against the approved supplier listAmount and budget against the GrantPayment against the bank's own limitsAmount against the approval thresholdWITHIN THE LIMITSSingle-use Warrant at releaseSpent as the payment is released, subjectto the bank's other payment controls.ABOVE THE APPROVAL THRESHOLDThe named approver confirmsRelease still requires the applicablechecks and a Warrant.OUTSIDE THE LIMITSRefused before money movesThe refusal is recorded, with theauthority and rule that applied.

Example

An invoice arrives with changed bank details. The bank's purchasing agent proposes paying the new account. Avallo refuses the payment, because the payee can only come from the approved supplier list. No money moves, and the refusal is recorded.

How Avallo connects

  • One API call. Avallo sits in the organisation's execution path, before any action takes effect. The first pilot validates this at the bank's payment release.
  • Different agent systems. Avallo is designed for integration with different agent systems; compatibility is confirmed in the pilot.
  • Fails closed. If authority cannot be established, the action does not proceed.
  • Shadow mode first. A pilot starts alongside the bank's existing controls, releasing nothing until the bank approves.

Where it runs and what it holds

  • Proposed hosting. Dedicated infrastructure in Australia, operated by or for the customer, with Australian data residency by default. Operator, model and support-access arrangements are agreed with the bank.
  • No customer identity. The control path uses agent identifiers, not customer identities.
  • No secrets. The control path holds no passwords, keys or reusable tokens.
  • No training. Customer data will not train any model. Policy documents, approvals and logs held outside the control path need an agreed data-handling design in the pilot.

Where AI is used, and where it is not

Not in decisions. No language model makes the runtime authorisation decision. Each decision is deterministic, so it can be tested, explained and audited.

Proposed: a drafting assistant. Designed but not built, it would read an organisation's policies, draft limits and link each to its source clause. People must approve every limit before it is enforceable; AI never approves a limit or decides an action. It would use a third-party model, chosen with the pilot organisation and run in Australia, and it is built during the first pilot.

How it would be tested. The pilot would test drafting accuracy against known-correct limits, include hidden-instruction cases, and replay proposed limits against past payments. Model or policy changes would require re-evaluation.

The evidence each decision leaves

Every decision is recorded: the decision, the rule that applied, who approved the Grant, and when. An independent verifier recomputes every decision byte for byte.

For a bank, the record shows which authority and rule applied to each decision, so internal audit or an independent party can check it. It provides decision evidence that supports CPS 230 control testing and, for later business-customer workflows, relevant Scams Prevention Framework controls and AFCA investigations. It does not by itself establish compliance or liability.

Illustrative record, not live data
Proposed action
Pay an approved supplier invoice
Checked against
Supplier payments Grant, approved by accountable people
Decision
Within the Grant: released
Warrant
Single-use, spent at release
Recorded
Rule applied, who approved the Grant, time

Where Avallo fits: the Enterprise AI Control Layer

Avallo is the runtime layer of TrustWorks360's Enterprise AI Control Layer. The other two layers prepare agents and policy before anything runs, and prove what happened afterwards.

  1. 01

    Prepare and govern

    Know what exists. Define what is allowed.

    • Agent discovery and visibility
    • Policy assessment
    • Policy translation
    • Agent onboarding

    Technology and status

    • AiriaThird-party product
    • SPQR PraxisExisting
    • TrustWorks360 integrationBuilt during the first pilot

  2. 02 Avallo

    Runtime guardrails

    Control what agents do at the point of action.

    • Runtime enforcement
    • Delegated authority
    • Action-time authorisation
    • Human intervention

    Technology and status

    • AvalloCore built and tested
    • SPQR AegisExisting vendor capability, early stage
    • TrustWorks360 integrationBuilt during the first pilot

  3. 03

    Assure and improve

    Prove what happened. Improve how agents operate.

    • Operational monitoring
    • Evidence and auditability
    • Compliance reporting
    • Performance optimisation

    Technology and status

    • SPQR Aegis receiptsExisting vendor capability, early stage
    • TrustWorks360 integrationBuilt during the first pilot

This is the target integrated capability, not yet one deployed solution; Airia and SPQR are separate products, not Avallo customer evidence. SPQR products are available now through TrustWorks360.

Start with one workflow

Avallo is ready for a scoped, paid pilot within 90 days: one consequential workflow, hosted in Australia. The pilot completes the remaining core work and builds the limits workbench, approval and monitoring screens and drafting assistant.

Discuss an Avallo pilot Status and evidence