Quick installation
Quick start
How bind() works
-
1Action declared — Your agent declares what it intends to do, at what authority tier.
-
2Tier resolved — The enforcement engine looks up the action in your authority rules table. Deterministic — no inference.
-
3Policy evaluated — Tier policy determines outcome: auto-approve, standard review, or authorize-all.
-
4Receipt signed — Ed25519 signed receipt produced. Append-only. Verifiable offline. Contains action hash, tier, outcome, timestamp.
-
5License returned — APPROVED, REFUSED, or ESCALATED. No license, no execution. Fail-closed.
Constitutional invariants
Fail-closedNo license, no execution
DeterministicSame inputs, same outcome
Append-onlyNo UPDATE or DELETE on receipts
Verifiable offlineEd25519, no call home required
Declared deltasSubmitter declares, never inferred
Tenant-sovereignData never crosses boundaries