Clearance
Authorizing Every AI Agent Action

Your AI gateway can tell you where a request went, but it never answered the question that matters: should this action happen at all? Gateways became a commodity this summer — JetStream Clearance wants to turn them into the last "authorization engine."

Gateways Are Commoditized; Authorization Is Still a Blank

Over the past summer, the AI gateway became a de-facto infrastructure layer: Rippling, Ramp, Databricks, Microsoft, and IBM all shipped one, joining Portkey, Kong, LiteLLM, and JetStream itself — nearly every enterprise has one installed. JetStream co-founder Raj Rajamani frames the problem bluntly: "Every enterprise I talk to has an AI gateway now, and that is exactly the problem. A gateway can tell you where a request went. The question our customers keep asking is whether the agent should have sent it at all, and until now nothing in their stack could answer that." (Source: JetStream official announcement)

Gateways cache, rate-limit, and log — they answer "what does the traffic look like." None of them evaluate "is this action allowed." This is not a small gap: an EMA and Cequence Security survey found 65% of enterprises have seen AI agents act beyond their intended scope, 29% with measurable organizational impact; only 34% evaluate whether an agent is actually authorized at execution time. (Source: EnterpriseDNA / SecurityWeek coverage)

What Clearance Does: Contracts, Parameters, Sequences

On September 2 at Fal.Con 2026, JetStream announced Clearance, a zero-trust reasoning engine: it intercepts every request at the AI gateway, maps the request to the identity behind it, the approved "design contract" authorizing it, the tool being invoked, and what that specific call is about to do — then decides to allow, deny, or flag before execution. JetStream calls this pre-execution authorization, as opposed to logging after the fact. (Source: The Robotics Media coverage)

Underneath it sits AI Blueprints — versioned operational contracts describing which models, MCP servers, tools, datasets, and identities each agentic system is assembled from. Policy binds to identity at access time and "reaches inside the tool down to the individual parameter": you can allow an agent to read a CRM record while blocking it from updating or deleting one. The sharpest difference is at the sequence level: an agent authorized to "query a customer record, prepare an attachment, and send email" is legal at every individual step — but if the final send suddenly adds an external BCC, that combination is a high-correlation data exfiltration pattern, and Clearance stops the send. (Source: JetStream AI Blueprints official page)

Our Judgment: Authorization Is a Pre-Execution Problem, Not a Post-Log Problem

What is genuinely valuable about Clearance is turning "should this be sent?" from a security team's verbal agreement into enforceable infrastructure. Detection and authorization are different jobs: runtime security platforms see what an agent did and respond at machine speed; Clearance decides whether the action runs at all. The former records losses, the latter prevents them. This distinction matters more than JetStream itself admits — it moves the zero-trust trust boundary from "identity" down to "the individual action," a fundamental correction to the classic "login once, trust forever" assumption. Agents today act at machine speed across multiple systems; reconstructing a trust chain afterward is architecturally wrong.

But our judgment goes further. Clearance's architecture rests on an implicit assumption: that AI Blueprint contracts are correct and current. Contracts go stale — an agent's scope, data sources, and toolset evolve, and if the Blueprint isn't updated, the authorization engine either over-permits (stale contract) or over-blocks (development throttled by governance). So the real governance bottleneck is not "do we have an authorization engine" but "who maintains the contract and how do we verify it reflects reality." This is the shared problem of every control-plane product in 2026 — Boomi, Capsule, JetStream alike: control itself is commoditized; the quality of control depends on the accuracy of intent.

What It Means for Buyers

If you are evaluating an AI gateway or agent control plane, there is now one more question you must ask: does it only route and log, or does it make an authorization decision before an action executes? Evaluate with four checkpoints. First, are contracts versioned and auditable (does the Blueprint describe the full set of models, tools, and identities)? Second, does permission granularity reach individual parameters (can you allow read but deny delete)? Third, does it evaluate action sequences rather than isolated calls (can it recognize "individually compliant, combinatorially malicious" patterns)? Fourth, does the decision happen before execution and is it auditable (is there a deny log, with reasons bound to the action)?

JetStream Clearance enters general availability this fall, backed by Redpoint Ventures and the CrowdStrike Falcon Fund, and was demonstrated at Fal.Con 2026. It is not "the standard" — it is evidence that "this category now exists." Whichever vendor wins, pre-execution authorization will become the new default of zero trust in the agent era.

Your Next Move

In your next gateway or control-plane selection, put "pre-execution authorization" into the evaluation matrix, and test it with a real scenario: construct a sequence that is legal step-by-step but malicious in combination (e.g., an email send that adds an external BCC), and see whether the candidate intercepts before execution or merely alerts afterward. If it alerts, you are buying an expensive log. If it intercepts, you are buying control.

References: JetStream official announcement (2026-09-02) · The Robotics Media coverage · EnterpriseDNA / SecurityWeek coverage (EMA/Cequence survey data) · JetStream AI Blueprints official page