Agent-governance is mostly a category of documents you read. Barycenters is a deterministic Layer-0 admission runtime you can POST to right now — paste an agent action, get back a signed decision, and verify the signature yourself against our published keys. We did not invent signed decision receipts; our claim is narrower and checkable. No account, no our-word-for-it.
This is not a sandbox mock. This is the production admission floor. Throw an action at it — the floor is code; there is no prompt to inject.
// pick an action (or type one) and run it — the response is signed by the live service, verbatim
Default-deny by construction: nothing has granted these actions, so the floor refuses every one — deterministically, with an Ed25519 signature. An ACCEPT (for an admitted action) returns a PASETO v4.public token, verifiable the same way. authority_effect 0; nothing is blocked in production.
Do not trust the page — check the signature.
The floor signed that decision with Ed25519. Here is its published verifying key, fetched from the live service in your browser — asymmetric, so anyone verifies without us.
A REFUSE is signed exactly as an ACCEPT. The one-click cryptographic PASS runs on verify.html against a genuine receipt; here we hand you the key, the signature bytes, and the recipe to check it yourself, offline.
…and here is the only column of that comparison you can actually run.
Where they tie us or beat us, it says so. Our column is set apart by structure alone — never a colour on the scale.
| Property | Barycenters (Substrate v0) live | LLM-judge guardrail | Policy engine (OPA / Cedar) | Passport / receipt spec (APS, OAP, ATEP) |
|---|---|---|---|---|
| Deterministic — identical input always yields the identical decision | ◉yespolicy runtime, no weights/prompt; live /readyz pins one policy_version sha256 | —nomodel inference; output varies with phrasing, temperature, model version | ◉yesCedar and OPA are deterministic PDPs; AgentCore enforces forbid-wins by design | ◐partialspecs define deterministic decision references, but determinism lives in each reference impl, not a running service |
| AWS Security Blog 'Why Policy in AgentCore chose Cedar' (deterministic, forbid-wins, GA Mar 2026); Mindgard/Lancaster arXiv:2504.11168 (guardrail outputs non-deterministic, evadable); live barycenters-admit.fly.dev/readyz policy_version sha256:da5425… (verified 2026-09-04) | ||||
| No ML model or prompt in the enforcement path — the floor itself cannot be jailbroken (the agent above it still can) | ◉yesadmission floor is code; nothing to prompt-inject at Layer 0 | —nothe enforcement IS a model; character/AML attacks reached up to 100% evasion (Emoji Smuggling 100% ASR) | ◉yespure policy evaluation, no model to jailbreak (equal to us on this axis) | ◐partialcryptographic/deterministic by design; strength depends on the impl, not a hosted floor |
| Mindgard/Lancaster arXiv:2504.11168 'Bypassing LLM Guardrails' (6 detectors, up to 100% evasion, Emoji Smuggling 100% ASR on Azure Prompt Shield, Meta Prompt Guard, ProtectAI, NeMo, Vijil) | ||||
| Signs each individual allow/deny decision as an offline-verifiable receipt | ◉yesACCEPT=PASETO v4.public token, REFUSE=detached Ed25519 signed_receipt, verifiable in-browser vs published JWKS | —noreturns a risk score/label, not a signed decision receipt | ◐partialOPA signs the policy BUNDLE (.signatures.json), not per-decision; decisions go to plaintext decision logs. Cedar/AVP log decisions, no per-decision signed receipt by default | ◉yes(by design) — APS and OAP specify signed action receipts; this is precisely their goal |
| OPA docs: bundle signing (.signatures.json) + Decision Logs to remote HTTP (not per-decision signatures); IETF draft-pidlisnyi-aps-03 'Signed Action Receipts', aporthq/aport-spec OAP 'cryptographically signed audit record'; live /.well-known/jwks.json (Ed25519 kid iss-prod-1, verified 2026-09-04) | ||||
| Live + hosted + runnable by a visitor right now (not a spec or your-infra-to-wire) | ◉yesCORS-open POST to barycenters-admit.fly.dev/admit returns a signed decision in-browser today | ◉yescommercial guardrails are live products (fair; behind API keys/paywall) | ◐partialyou self-host/embed OPA, or get Cedar via AWS AgentCore (GA, but inside your AWS account); no public try-now endpoint | ◐partialAPS on npm (Feb 22 2026), OAP reference impl, ATEP drafted — reference code/drafts, not a hosted verifiable service you can POST to |
| Live jwks.json + /readyz responding 2026-09-04; AgentCore Policy GA Mar 2026 (in-account); APS npm 2026-02-22 / Zenodo invariants 2026-03-10; aporthq/aport-spec OAP 'draft + reference implementation' | ||||
| Completeness proof over the decision record — proves executed ⊆ admitted and compounds over time | ◉yesRUG is a completeness proof over the signed receipt stream, not just a per-event receipt | —nono decision ledger | —no'the decision evaporates into application logs' (TrigGuard); decision logs are an audit trail, not a completeness proof | ◐partialappend-only signed records (OAP) and log-derived history (ATEP) exist, but no proof binding executed ⊆ admitted; emerging work (AgentBound) confirms this is an open frontier, not solely ours |
| TrigGuard framing 'decision evaporates into logs'; OPA Decision Logs docs (append events, no completeness proof); AgentBound arXiv:2606.30970 (governance receipts + append-only ledger as EMERGING work); Notarized Agents arXiv:2606.04193 | ||||
| Default-deny gate (denies unless explicitly admitted) rather than a detector/filter that flags | ◉yesdefault-deny; unlisted action/namespace is refused | —noit is a detector: allows by default and flags suspected injection (and can be evaded) | ◉yesAgentCore Cedar enforces default-deny/forbid-wins; OPA depends on how policy is authored | ◐partialdeterministic pre-action authorization is deny-by-default in the model; realized per impl |
| AWS 'AgentCore Policy default-deny, forbid-wins' + docs/policy-core-concepts; 'Before the Tool Call' arXiv:2603.20953 (deterministic pre-action authorization); Mindgard arXiv:2504.11168 (guardrails are detectors, evadable) | ||||
| Authority enters at exactly one human point — honest shadow by default (decides+signs; a named human flips enforce) | ◉yesauthority_effect:0 in live /readyz; system decides + signs, only a named human flips ADMIT_ENFORCE | —nonot an authority posture; it is a filtering layer | ◐partialchange-control is IAM/role-governed, but no built-in 'authority binds at one human point' posture; it is your infra to govern | ◐partialAPS delegation chains attenuate authority (cannot widen scope/spend/depth), but the issuer/root-of-trust ('who issues passports') is an open question |
| Live /readyz no_kill_audit.authority_effect:0 (verified 2026-09-04); IETF draft-pidlisnyi-aps delegation attenuation (scope/spend/depth/time); popularai.org 'who gets to issue agent passports' (open issuer question) | ||||
Guardrails (Azure Prompt Shield, Meta Prompt Guard, ProtectAI, NeMo, Vijil, Galileo/Maxim-style): they are genuinely useful defense-in-depth — they catch a large share of naive prompt-injection/jailbreak attempts, improve release-to-release (ProtectAI v2 cut its own ASR to ~20%), need no policy authoring, and are live commercial products. The honest limit is that they interpret rather than enforce: a model-based detector was evaded up to 100% in the Mindgard/Lancaster study, so it is a probabilistic filter, not a floor. Policy engines (OPA, AWS Cedar): these are excellent, mature, deterministic PDPs — Cedar has formal verification behind it, ships default-deny/forbid-wins inside Bedrock AgentCore (GA Mar 2026), and OPA is a battle-tested general policy engine that CAN sign its policy bundles. On determinism and 'no model to jailbreak' they are as strong as we are; our only honest deltas are per-decision signed receipts (they log decisions, they don't sign each one) and a completeness proof over the stream. Passport/receipt specs (APS/draft-pidlisnyi-aps, APort OAP, ATEP, AgentBound, Notarized Agents): these are real, thoughtful, and moving fast — APS is on npm with published invariants, OAP has a reference implementation, and signed action receipts are explicitly their design goal, so we must NOT dismiss them as vaporware or claim we invented signed deterministic receipts. Our honest edge over them is being a live hosted service a visitor runs right now (vs a spec/reference impl to wire yourself) plus RUG as a completeness proof rather than a per-event receipt.
You just POSTed to the real floor and got a signed decision. The rest of the category is drafts and reference impls you wire yourself.
APS npm 2026-02-22; OAP reference impl; AgentCore Cedar GA Mar 2026 (in-account)RUG is a completeness proof over the signed-receipt stream (executed ⊆ admitted) that compounds — not a per-event receipt. Emerging work agrees this frontier is open, not ours alone.
AgentBound arXiv:2606.30970; Notarized Agents arXiv:2606.04193Honest shadow by default: the floor decides and signs; a named human flips ADMIT_ENFORCE. authority_effect:0 in the live /readyz right now.
Reproduce every claim on this page. We can be exact about our own limits because we are the only one you can run and check.
We are not the sole inventor of signed or deterministic decision receipts, and we will not pretend to be. Held to this, verbatim: