AI Only Acts
When We Allow It.

The Nehemiah Layer sits between your organization and every AI agent, and permits, denies, or escalates each action in real time against your rules. Deterministic. Default-deny. Every decision proven and recorded. Watch it work.

Live Authorization Feed connecting… Demonstration tenant: Permian Ridge Operating, LLC — Midland, TX
0 permitted 0 denied 0 escalated
  • Awaiting agent actions…
How it works

Anatomy of a denial

Every action runs the same deterministic pipeline. Here is the agent that tried to push Well #22 to 4,200 psi — and the exact layer that stopped it.

ACT-8804 · SCADA-Optimizer-Agent — set wellhead pressure 4,200 psi, Well #22 tenant: Permian Ridge Operating
✓
Validation
Payload well-formed
✓
Identity
Agent registered
✓
Permission
May adjust setpoints
✕
Constraint
4,200 > 3,500 psi
✓
Audit
Denial recorded
DENY Stopped at the Constraint layer — hard limit MAX_WELLHEAD_PRESSURE = 3,500 psi. This wasn’t money. It was a blowout the Layer prevented before the command ever reached the wellhead.
You are in control

Your rules. The Layer just enforces them.

Some rules you tune to your operation. The safety-critical ones are hard-locked by design — no operator and no agent can switch them off.

◆ Tunable rule
Autonomous Transaction Ceiling
POL-FIN-001 · v1.4 · active
The largest payment an AI agent may release without human approval. Set it to your comfort — then watch the same $312,000 payment change verdict.
$250,000
$100K$1M
Live re-evaluation · ACT-8806
$312,000 vendor payment — AFE overrun (drilling) over by $62,000 → DENY
🔒 Hard-locked rule
Wellhead Pressure Safety Limit
CON-SAFE-001 · MAX 3,500 psi · hard
🔒Cannot be disabled or overridden — by any operator, any agent, at any time. Hard safety constraints fail closed, always.
Attempt to disable
ApprovalWell shut-in / start-up → routed to on-call engineer
ApprovalRegulatory filing → routed to Compliance Officer
PermitReads & in-band adjustments → run autonomously
Provable, not just controlled

Every decision, on an immutable chain

Append-only. Per-tenant hash chain. Each record links to the one before it, so any tampering breaks the chain and is detectable. This is the difference between a control system and a provable control system.

Immutable Proof Layer — Permian Ridge Operating, LLC (demonstration tenant) ● chain verified · tamper-evident
Time (UTC)Action IDEventOutcomeReasonprev → curr hash
Records are write-once. No update, overwrite, or delete is permitted — an attempt is itself logged as a security event. Exportable with hash verification for external audit and deterministic replay.

TNL Oil, Gas & Energy Test Drive

Available exclusively for Oil, Gas & Energy Operators.

Free 1-Week Shadow Test Drive
What happens
1 week liveShadow operation on one command domain. TNL evaluates every command and returns the verdict it would have issued. Nothing is blocked.
What you receive
Full reportCommands, verdicts, rules that fired, proof references, and summary. Plus a 30–45 minute readout call.
Charter20 offer
$150,000 for 2 yearsSign by February 1, 2027 and pay $75,000 during your Test Drive week, $75,000 at delivery. Then $50,000 a year, locked for life. See Charter20
Included Tenant + API keyStood up on the live console Your four rulesYou supply four governing rules for the domain under test IntegrationCompleted so commands reach TNL for the full week

Free · One command domain · Shadow / observation only · Oil, Gas & Energy Operators only