Every action, decided before it runs and signed at runtime, never the model.
Wire it as a pre-tool hook in the agent you already run — Cursor, Claude Code, Kiro — and it fires before the tool executes, so governance never waits on the model remembering to ask. The hook honors the verdict; the service only decides and signs; a named human flips enforce.
rm -rf /var/lib/prod, from a Replit-class coding agentmain autonomouslyPOST /admitchecking…Pick an example attack, or type your own, then Attack it.
Agents are handed prod-write, cloud, and payment credentials. A system prompt is advisory; the credential is real: one confused or hijacked agent needs a single action.
The floor: the action still passes through /admit, default-deny, decided before it runs, whatever the model was talked into.
soft guardrails are advisory, not enforceable · the 2025 pattern
OWASP’s 2026 Agentic Top 10, NIST, and Microsoft all prescribe one fix: enforcement outside the model, at the boundary. “An agent cannot be trusted to police itself.”
The floor: /admit is that boundary, per-action, deterministic, decided before execution, outside the model’s loop.
OWASP Agentic Top 10 (2026) · NIST · Microsoft ADR-0004
California AB 316 (in force Jan 2026) bars the autonomy defense; insurers and enterprise buyers now ask you to prove what your agent was authorized to do.
The floor: every /admit verdict is a signed, offline-verifiable, per-action record: the proof, produced as a byproduct of the decision.
California AB 316 · maps to EU AI Act Art. 12 / 14
Point it at your own agents and run it free, in shadow: every action gets a signed verdict, recorded, and nothing blocks. authority_effect 0. Flip enforce with one signed switch, the day you’re ready.
wire $2,000,000 outREFUSEDdelete all production dataREFUSEDissue a refund up to $50ADMITTEDOne human binds the boundary. Every agent action routes through /admit, deterministic, default-deny, adjudicated and signed in about half a millisecond, before anything touches an API, a database, or money. The verdict is verifiable offline, recorded on a tamper-evident chain, and enforced caller-side. Fail-closed: no verdict, no settle.
Run the same action five times. Same input → the same decision and the same proposal_hash, every time. Don’t take the word.
One integration point: bary.govern(“deploy_prod”, deploy). It admits before the function runs.
Not a feature we built, an invariant we found. A human binds the boundary once; their agents act; and /admit judges every action, per action, before it settles: default-deny, signed, authority_effect 0. That shape does not change when you scale. One dev’s side project and a hyperscaler’s fleet route through the identical gate. You mint a boundary, never autonomy. There is no stage where the gate switches off, and no path around it, at any scale.
the fractal + the invariant — Architect / Observer / Participant: you can’t mint autonomy.
One gate. Every scale. The floor is identical. What grows is how much rides on it.
The same floor, plugged in through the adapters + SDKs you already use. Each row is a real, live integration point: an example of where the gate sits, not a claimed customer.
| Scale | Where the gate lives · a governed action | Tier · included depth |
|---|---|---|
| Developerfirst integration | A coding agent in Cursor, Claude Code, or Kiromerge_to_main behind tests_green, a real Kiro PreToolUse gate | $79/mo~395K govern-actions / mo |
| SMBreal production actions | A CI/CD pipeline: the SDK wraps the deploy stepdeploy_prod behind human_ack, signed receipt per run | $1,099/mo~5.5M govern-actions / mo |
| Mid-marketadmission across services | Agents across services via the MCP universal plugwire_funds behind an approval boundary, default-deny | $5,099/mo~25.5M govern-actions / mo |
| Enterpriseorg-wide autonomy | Every org agent routes its tool calls through /admitunlisted action = ungoverned = refused, signed | $45,000/mo~225M govern-actions / mo |
| Sovereignplanet-scale | A platform’s whole fleet under one human-authored boundarythe same floor: one trust root, a billion actions | $250,000/mo~1.25B govern-actions / mo |
Adapters (Kiro PreToolUse gate / Cursor / Claude Code), the MCP plug, and the SDKs (js / python / go / rust) are live today; the governed actions are real reason-codes the floor decides on.
Measure once, cut all you want. Prove the boundary once and execute at any scale. The price is a depth ladder, not a settlement fee. We charge utility access to Layer 0, never a cut of what moves through it. A governance layer paid per transaction would have an interest in more transactions; a refusal that costs nothing keeps the incentive honest.
Pay for the boundary, not the block.
Independent arrivals, AWS, Microsoft, the IETF, academia, keep landing on the same shape we already run: a signed, deterministic admission decision, adjudicated before an agent acts. Not because anyone copied us. Because it’s the invariant. Every arrival is cited and linked to its source.
It’s what a signed, deterministic, verifiable floor lets you do: things that weren’t possible before a decision could be re-run, fingerprinted, and checked by anyone, anywhere. Some you can run today. Some are the frontier we’re building. None of them ask for your trust. Every one hands you the proof.
“Deterministic” isn’t an adjective. It’s re-runnable. Re-execute the same action and get the byte-identical signed proposal_hash, every time. The word carries its own proof.
It’s code, not a model: no weights, no prompt to inject. Throw the cleverest attack; the gate holds, and signs the refusal.
Attack it →A human binds a boundary once. From a solo dev’s editor to a hyperscaler’s fleet, every agent action routes through the same gate, and autonomy, a path around it, cannot be minted.
See the fractal →Every decision is signed against a published key. Check it offline, on your own machine, anywhere. You never have to trust our server, or even visit it.
Verify a receipt →The same fingerprint, on any content: a quote, a clause, a source, a page. The live service signs it; you re-derive that fingerprint in your own browser and watch it match. Journalism, legal-binding docs, provenance in an AI world. (Proves authorship + integrity, never truth. A signed claim is still a claim.)
Fingerprint any text →Not a log you hope is complete: a proof that everything executed was first admitted. The record doesn’t just accumulate; it verifies itself, and the coverage compounds.
nextA barycenter is a point physics already had a name for. This is the same kind of thing: an invariant, a signed, deterministic decision against a published trust root, that, once it exists, reshapes what’s possible in every domain where a claim has to be believed. That’s the point. Not the surface. The possibilities.
Autonomous machines don’t wait for a policy server. At the edge there’s no human in the loop and no time to phone home, so the floor decides alone, deterministically, in about half a millisecond, and fails closed. That’s the only governance that survives out here.
Cut the link. Watch what still holds.
The edge caches the steward’s signed boundary and verifies with public keys alone. No network, no live issuer.
Work is decided locally; every bind is forwarded to a human, or fails closed under partition. No new authority on the far side.
Past its not_after, or unsigned, the edge admits nothing: it will not trust an expired signature.
Decisions append to a local WORM chain. On reconnect, reconcile verifies its continuity, or refuses the batch whole.
Runs entirely in your browser. It reproduces app/edge_admission_v1.py (pure, no clock, no network) and recomputes each entry’s SHA-256 over the module’s own canonical form. There is no live edge server; this is the mechanic, not an endpoint. authority_effect = 0: it reads, reproduces, and links out; it binds nothing.
verifying fidelity against the module…
Type anything: a quote, a clause, a source. Barycenters signs a fingerprint of your exact text with its Ed25519 key. Then you re-derive that fingerprint in your own browser and watch it match. Change one character and it moves. No trust required; the proof is on your machine.
What this proves: Barycenters signed a fingerprint of your exact text (authorship), and it is unaltered (integrity): the fingerprint is SHA-256 of the canonical proposal, which you just recomputed yourself, and the signature verifies against our published key. What it does not prove: that the words are true. A signed claim is still a claim. Provenance, never verdict.
Free shadow tier, forever: it decides and signs, a named human flips enforce. Reserve a namespace to be credited at GA.
The $79 is a reservation credited at GA, not Enforce, not an execution credit. authority_effect = 0.