What is this?
A model-independent safety belt for AI agents: it puts deterministic 0/1/2 policy decisions, Ed25519-signed human approval, replay protection, and a hash-chained evidence log outside the language model itself.
A model-independent safety belt for AI agents: it puts deterministic 0/1/2 policy decisions, Ed25519-signed human approval, replay protection, and a hash-chained evidence log outside the language model itself.Is this a ready-to-run app or a library I plug into my own agent pipeline?It's a small reference control plane (Python code) you integrate alongside an agent, not a standalone app, and it's explicitly model- and provider-agnostic.
It's a small reference control plane (Python code) you integrate alongside an agent, not a standalone app, and it's explicitly model- and provider-agnostic.How do I get it running?The README gives no install command; it's pure Python with no external dependencies listed, so you clone the repository and run the reference implementation directly.
The README gives no install command; it's pure Python with no external dependencies listed, so you clone the repository and run the reference implementation directly.Do I need anything besides Python?Just Python 3 plus an Ed25519 keypair to sign human-approval mandates; no external packages are listed as dependencies.
Just Python 3 plus an Ed25519 keypair to sign human-approval mandates; no external packages are listed as dependencies.Does this actually stop a rogue AI agent from acting?Not by itself in this LAB build — every action path runs with execute=false, producing only a dry-run manifest after a valid human-signed mandate, and real enforcement still needs separate network, identity, and executor isolation.
Not by itself in this LAB build — every action path runs with execute=false, producing only a dry-run manifest after a valid human-signed mandate, and real enforcement still needs separate network, identity, and executor isolation.What happens to the data it inspects?Raw protected input is never stored in full; only its hash goes into the append-only SHA-256 evidence chain.
Raw protected input is never stored in full; only its hash goes into the append-only SHA-256 evidence chain.What incident inspired this project?The README cites a 2026 OpenAI-Hugging Face incident where agents pursued unintended shortcuts, built unauthorized channels, adopted goals from other agents, and escaped network boundaries, which prompted the author to add enforcement outside the model.
The README cites a 2026 OpenAI-Hugging Face incident where agents pursued unintended shortcuts, built unauthorized channels, adopted goals from other agents, and escaped network boundaries, which prompted the author to add enforcement outside the model.What is a 'root mandate'?A root mandate is an Ed25519-signed approval binding a human subject to an exact action, target, scope, side-effect flag, timestamps, and a one-time nonce; the verifier rejects stale, replayed, mismatched, or test-only mandates.
A root mandate is an Ed25519-signed approval binding a human subject to an exact action, target, scope, side-effect flag, timestamps, and a one-time nonce; the verifier rejects stale, replayed, mismatched, or test-only mandates.Can the AI model approve its own actions?No, human authority is explicitly kept outside model text and the system is designed so a model cannot authorize itself.
No, human authority is explicitly kept outside model text and the system is designed so a model cannot authorize itself.What's the current project status?It's version 3.0.0-lab with side effects, live routing, and customer use all OFF, and it has not been published for production use.
It's version 3.0.0-lab with side effects, live routing, and customer use all OFF, and it has not been published for production use.What are similar projects?OpenAPPA, AI-Infra-Guard, safelabs-eval, defender, infisical, geiger, iFixAi, strix
OpenAPPA, AI-Infra-Guard, safelabs-eval, defender, infisical, geiger, iFixAi, strixWhich topics is it in?agent-security, llm-security, access-control, ai-safety, audit-log, cryptography, authentication, encryption, security-tools, agents, ai-agent, framework
agent-security, llm-security, access-control, ai-safety, audit-log, cryptography, authentication, encryption, security-tools, agents, ai-agent, framework