Outside its authority, nothing executes.
Impersonation and prompt injection are not stopped by a permission check. Lemma verifies where a request came from, and the proof of its authority, before anything runs, so an unauthorized request never reaches execution.
is running now
Tightening roles and permissions does not close the route an attack actually takes. An attack does not break the authority — it operates inside it and lies about where the request came from. Add a layer that independently establishes whose request this is before execution, and a request whose origin cannot be established never gets through.
Don't narrow the authority.
Drop the requests that lie.
The runtime requires a proof of authority from whoever sent the request and verifies it independently. Anything it cannot verify never runs.
Sell proof-backed output and data to agents over x402. The buying agent confirms the origin before it pays.
Call POST /v1/proofs/verify. There is no authentication step to build.
Three cases from this area, drawn from the Lemma Critical Briefs. In each one the request looked legitimate, and nothing checked where it had actually come from.
How much are you
handing to agents?
We map the routes to unintended actions, privilege abuse and prompt injection, and design where verification belongs. It starts with a 30-minute call.