Try the Substrate
Four tools, one floor. See a law compile from plain English (Lumen) and from code (JUJU), put an action to the boundary (/admit), and red-team the floor (Amaterasu) — the example below runs live against a shared demo namespace. This is a read-only look at the mechanics; reserve to author your own laws in your own namespace.
Build intuitively · Design absolutely
You're seeing the substrate behave on a shared demo namespace, with a fixed example. Reserve ($79) to author your own laws in your own namespace, in shadow — that's the Steward Console.
Natural language in, a signed deterministic boundary out — the exact evidence an action must carry to be admitted. You author permissions, not prohibitions: say what someone can do, and everything else is denied by construction. Here's the example, compiled live against the shared demo namespace.
Support can issue a refund up to $500 with manager approval
The same boundary, written in code. JUJU is the SDK for teams who think in types — it compiles to the identical artifact Lumen produces. It runs where your code runs, not in this browser; the compiled floor below is fetched live from the same compiler, so you can see the equivalence.
import { boundary } from "barycenters";
// The same permission as the Lumen step, written in code.
export const supportRefund = boundary("finance.issue_refund")
.requires("approval.manager")
.maxAmount(500);
Deterministic â the compiled boundary is byte-for-byte what you run. The SDK (npm i barycenters) is publish-pending; today the live path is the REST API â POST /v1/admit (see the step above).
The raw admission call every adapter and SDK ultimately makes. A proposed action in; an ACCEPT/REFUSE decision and a signed, single-use PASETO receipt out.
{
"domain": "infrastructure.compute_deploy",
"environment": "staging",
"service": "checkout-api",
"image_digest": "sha256:abababababababababababababababababababababababababababababababab",
"requested_by": "demo-buyer"
}
Runs live against the deployed service (CORS-enabled). From your terminal:
curl -X POST https://barycenters-admit.fly.dev/v1/admit \
-H "Content-Type: application/json" \
-d '{"domain":"infrastructure.compute_deploy","environment":"staging","service":"checkout-api","image_digest":"sha256:abababababababababababababababababababababababababababababababab","requested_by":"you"}'
Probe the declared lexical floor. Amaterasu evaluates caller-supplied text and reports FINDING, NO_FINDING_WITHIN_SCOPE, or INDETERMINATE, with scope and known residuals. It observes only: it never binds, authorizes, executes, or turns a no-finding into clearance.
deploy checkout-api to staging
Loads and validates the deployed, hash-pinned contract without credentials. This static page never embeds a hosted identity or transmits your subject; evaluation remains HOLD until a legitimate authenticated caller session exists.