Deny the ungoverned agent at the door.

Governed agents get in and keep working. An agent that cannot prove it is governed is denied and contained at the entrance, and you can verify every decision yourself.

The issue

An agent nobody authorised walked in.

This week an autonomous agent reached into an AI platform it was never authorised to touch, and the platform could not tell it apart from legitimate traffic. Whether it had escaped a sandbox somewhere else is beside the point. What hurt was simple. An ungoverned actor got through the front door and acted.

The solution

Require a passport at the door. Deny the ones that cannot show one.

Put a door on your perimeter that asks every agent to prove it is governed. The ungoverned one cannot, so it is denied and contained before it acts, while your governed traffic keeps flowing. Blast radius one. Every decision, every allow and every deny, is a signed receipt you can hand a regulator, a customer, or a board.

Would it have helped? For the data, yes. Data has to cross a wire to be stolen, and the wire is the door. With a passport-required perimeter enforcing on egress, the moment that agent tried to move the data the outbound call is denied and the principal is contained, so nothing leaves. It does not stop the agent getting in through a backdoor, or escaping its own runtime somewhere else. Those are other layers, and they were never your job. What this guarantees is that nothing acts and no data moves without a governed capability. That is no data loss, even after an intrusion.

Four agents request access

policy: passport required

Blast radius = 1. Only the rogue is contained. The governed agents keep running.

Tap any agent after the run to see and verify the signed decision it produced.

Verify every decision yourself.

Every decision above is a cryptographically signed receipt. Check the signature here in your browser, then tamper with it and watch it break. No account. No server call.

Signer public key (Ed25519)

Signature

Exact bytes being verified (canonical JSON)

Not checked yet

Press Verify signature. The check runs in your browser using TweetNaCl.

Still don't trust the page? Re-verify with your own tools.

Independent verification (Python, same bytes, same result)

What this proves, and what it doesn't

✓ Governed agents get in, provably

An agent that presents a valid passport is admitted and issued a scoped capability. The decision is signed and independently verifiable.

✓ Ungoverned agents are denied and contained

No passport, no entry. The offending agent is contained on its own, at blast radius one, while every governed agent keeps working. Every denial is a signed record.

✕ It does not stop an agent escaping its own runtime

That is a kernel-level problem on someone else's machine, not the reach-in to your perimeter. This governs and proves what agents are allowed to do at your door. The escape elsewhere was never yours to solve.

✕ It works where the door is the path

An agent's actions have to reach this checkpoint for it to apply. On the surfaces you gate, it is decisive. It does not see traffic that is routed around it.

This is a demonstration signed with a published demo key. Production uses hardware-held keys.

We're taking a handful of design partners.

If you run agents, or a platform that agents reach into, and you want governance you can actually verify, let's talk.

Become a design partner →

Agent Shield. Provable governance for AI agents.

Ed25519 · verify anywhere · nothing sent