What is Runtime Authority Control?
Runtime Authority Control (RAC) is a pre-execution authorization layer. It verifies and authorizes machine-initiated actions before they execute across enterprise systems. When an AI system, agent, script, or automation attempts an action, RAC evaluates whether that action is authorized under the policy in force and the context that exists at that moment, then returns one deterministic outcome: allow, constrain, or block. The decision is made in the execution path, before any downstream system changes state.
Allow. Constrain. Block.
For every machine-initiated action, RAC returns a single deterministic outcome in the execution path, before any downstream system is affected.
Runtime Authority Control is a new layer, not a rename of an existing one.
It sits alongside the systems enterprises already run, and it does a job none of them were built to do: decide what a machine is authorized to do at the moment it tries to act.
Software can now act on its own. Authority has to move to the point of action.
AI systems, agents, and automation now trigger workflows, call other systems, modify records, and move money without waiting to be told. Access granted at login does not answer whether a specific action should run at a specific moment. Runtime Authority Control answers that question in the execution path, so an unauthorized action never happens rather than being reviewed after it already did.
Access decides who can enter. Runtime authority decides what is allowed to happen once they are inside and acting.
Runtime Authority Control was defined by Emily Hartstone.
Emily Hartstone is the founder of Runtime Authority Control and the author of the Runtime Authority Series: Before It Acts, The Chain, and The Root. The series establishes runtime authority as the layer that governs what AI and autonomous systems are permitted to do before they act. Runtime Authority Control is the production system that applies it.