"Delegate Merge Authority Safely — Introducing TrustRelay"

TrustRelay is the independent authorization layer for agent-authored code change. It sits at the merge boundary, evaluates evidence against deterministic policy, and issues a signed, verifiable decision before anything merges.

This is not a dashboard. It is not an audit log. It is not a coding agent or a compliance automation platform. It is a neutral authorization layer that observes every agent-authored pull request, assembles a verifiable evidence snapshot, applies deterministic policy, and independently authorizes the change before it merges.

What this means for developers

If you are a developer using GitHub Copilot or Cursor, here is what the TrustRelay experience looks like.

You open a pull request as you normally would. TrustRelay detects which parts of the change were agent-authored, establishes attribution, and assembles evidence from GitHub, Jira, and your CI/CD pipelines. Deterministic policy is applied. The result appears as a GitHub check on your pull request.

If the check is APPROVE, your PR can merge normally. TrustRelay has independently verified that the change meets your organization's policy requirements.

If the check is BLOCK, the PR cannot merge. The check output explains why with a stable reason code and a clear description of what is missing. You can provide the required evidence (for example, link a Jira issue or add a human sponsor), and TrustRelay will reevaluate.

If the check is ESCALATE, additional review is required. A designated reviewer receives a notification and can approve or override the decision. The override path is controlled by your organization, and the original decision is never rewritten.

The key point is that the primary surface is the GitHub check. You do not need to learn a separate governance tool, log into a dashboard, or change your workflow. The check output gives you everything you need: what happened, why, and what to do next.

How TrustRelay works

The system follows four steps for every pull request.

Observe. TrustRelay monitors GitHub pull requests where AI coding agents have contributed code changes.

Attribute and collect evidence. TrustRelay identifies which coding agent contributed to the change, binds the work to a human sponsor, and assembles a versioned evidence snapshot from GitHub, Jira, and CI/CD pipelines.

Apply deterministic policy. Your policy is applied to the evidence snapshot. The result is APPROVE, BLOCK, or ESCALATE, each with a stable reason code and a complete explanation. No AI makes or modifies authorization decisions.

Enforce and record. A signed Agent Change Passport is issued to the immutable ledger. A GitHub required check reports the outcome. Overrides and production outcomes are preserved without rewriting history.

The thesis

Our hypothesis is that platform and security teams will allow TrustRelay to replace some mandatory manual review for low-risk, agent-authored pull requests when it provides reliable attribution, required evidence, a reproducible policy decision, an understandable explanation, and a customer-controlled recovery path.

This is a testable claim. The product succeeds only when a customer delegates real merge authority. Reports and passports without an enforceable control point are necessary technical progress but insufficient market proof.

Getting started

TrustRelay starts in shadow mode, where the system observes and reports but does not block. Your team can review decisions, examine evidence, and build confidence. From there you can transition to advisory mode and, eventually, to limited enforcement on a defined repository envelope.

Contact us to start a pilot and test the thesis with your team.