A Japanese station gate gave us an uncomfortable question about AI agents: why put the entire approval process at the exact moment an action is ready to run?
ZeroGate explores a different arrangement. Prepare a signed approval for an exact action before it reaches the execution boundary. At dispatch, check the actual request against that approval and record one-time admission before attempting the external operation. The ambition is a governed interaction that feels more like tapping through a gate than waiting at a counter.
Our controlled Azure comparison reduced dispatch-boundary p95 from 334.000 ms to 9.802 ms at concurrency 32. That is a 97.1% reduction at that boundary, not an end-to-end speedup. We are publishing the preparation costs, failure cases and evidence alongside it.
What the Japanese gate changed about our thinking
The interesting lesson from Suica and Sony's FeliCa is not a particular millisecond target. It is the discipline of deciding what must happen during a short interaction and what can happen before or after it. A passenger experiences a brief passage because the surrounding system has been designed around it.
Agent governance has a similar design opportunity. Policy evaluation, action construction and approval preparation need not all begin when a tool call is already waiting to leave. If the final request is known early enough, some of that work can happen beforehand. What cannot move out of the boundary is the check that the request being dispatched is still the one covered by the approval.
This is an architectural analogy, not a claim that we reproduce a railway protocol or its transaction speed. We discuss the inspiration in the whitebook, with references to Sony's FeliCa design and Suica's system development. There is no Sony or JR East affiliation.
A pass for this action, not permission to do anything similar
In the evaluated reference design, an Action Pass is a signed, short-lived, single-use grant for an exact action. It is not a reusable permission for a tool or a category of work. Changing the outgoing payload means the old pass no longer covers the request.
The gate reconstructs the action, checks its fingerprint and the bound authority, verifies the relevant session and freshness conditions, and atomically records admission while consuming the pass. Only then does the trusted adapter attempt the external action. Admission is not evidence that the external action has already succeeded; the outcome must be recorded separately.
An invalid or reused pass is rejected. Missing or stale evidence must not quietly become permission: the workflow needs fresh authorization or an explicit review path. A local snapshot also cannot prove that the outside world has not changed. The paper makes those trust and freshness assumptions explicit.
What we measured, including the inconvenient part
We ran 4,800 controlled Azure storage attempts, comparing synchronous approval with prepared approval using the same reference issuer and gate. Each mode was tested at concurrency 1, 8 and 32, with five trials of 160 attempts per setting.
| Tested concurrency | Synchronous boundary p95 | Prepared boundary p95 |
|---|---|---|
| 1 | 25.018 ms | 11.374 ms |
| 8 | 45.379 ms | 10.303 ms |
| 32 | 334.000 ms | 9.802 ms |
The prepared boundary stayed around 10-11 ms in these settings. But preparation still costs time. At concurrency 32, the mean full lifecycle increased from 483.925 ms to 2,012.902 ms, including advance preparation and batch waiting. The experiment moved work away from the last boundary; it did not make the whole task faster.
The practical question is whether that preparation can fit into time a real workflow already spends on other work, while the evidence remains fresh. We have not yet established that user-experience benefit in customer production. This is not a competitor benchmark or a hosted-service SLA, and tested concurrency is not a claim of parallel gate writers.
The report also includes 292 authored semantic combinations and ten controlled fault histories. These probe decision correctness and failure behavior, rather than measuring latency. They are not independent real-world labels or evidence of a universal zero-failure rate. The cloud runner is trusted; this study does not establish that a malicious executor cannot bypass a production gate.
How this connects to OSuite
ZeroGate changes the timing of governance work, not the source of authority. CAVA supplies the action identity that a pass can bind to. PCAA provides the authority and proof model; BAF contributes the bounded-approval perspective. AREG can inform the wider exposure context. Those are architectural connections, not a claim that every full product workflow was exercised in this benchmark: the measured path uses a reference issuer and gate.
It also leaves the skill-boundary distinction intact. A skill can request authority, but it cannot grant itself a pass. Runtime authorization may narrow or deny that request. Preparing approval earlier does not give the skill a way around that decision.
Local authorization and signed capabilities already exist. Our contribution is the explicit ordering of exact-action preparation, boundary revalidation, durable one-time admission and outcome evidence, together with a testable account of what that ordering gains and costs.
Read the design, then inspect the evidence
Start with the 22-page ZeroGate whitebook for the transit-inspired design, operating sequence, OSuite relationships and result charts.
The arXiv research report, ZeroGate: Trust-Preserving Fast Paths for Governed AI Agent Runtimes, contains the formal model, experimental details and limitations. You can open the paper PDF directly or download the version-pinned source and evidence archive. The paper is a preprint, not a peer-reviewed acceptance.
Verify the unchanged archive first. If you change cases or the evaluator, use a separate copy and report new outputs as a new experiment. The source archive attached to this paper is the reproduction target for the measurements above, rather than the earlier ZeroGate prototype release.
If your team has an agent workflow where the final action is known before dispatch, talk to us about evaluating it. That is where we want to test the next question: whether a shorter governance boundary can become a better everyday experience without weakening the control.
