Admission control for AI agents
ANANS decides, before an agent executes, what it is allowed to touch — and produces evidence afterwards that a reviewer who was never present can check offline, on their own machine, without trusting us.
See the walkthrough → Run the proof yourself → What is and isn't built →
Coding agents can now produce in an afternoon what used to take a quarter. Everything downstream of production became the constraint: review, sign-off, compliance, and the question nobody can answer cleanly — what exactly did it do while nobody was watching?
The common answer is a log. A log is written by the thing being audited, and it can only be read by someone who already trusts the system that wrote it. When a regulator, a client, or your own security team asks for proof that an agent stayed inside its authority, a log is an assertion, not evidence.
The gap isn't capability. It's that nothing in the stack was built to be checked by a stranger.
Three properties, in that order. The order is the design: nothing downstream can repair a decision that was never made.
An agent receives a task bound to an authority that already existed — exact action, allowed paths, resource ceiling, and an expiry. Authority is granted by policy or by a person, never assembled by the agent from its own confidence. Absent or ambiguous authority is a refusal, not a warning.
Agreement among reviewers, ensembles, or planning loops can change what is known. It cannot change what is permitted. A component that evaluates whether a condition is met must not also be able to widen the condition, extend its own window, or approve its own output.
Every decision, admission, effect, and refusal writes a receipt into a hash-linked record. The record ships with an offline verifier. Someone who was not present, and who has no access to the running system, can determine what the run supports — and, just as importantly, what it does not.
Four different states, kept apart on purpose. A specification is not an implementation, an implementation is not a validation, and a validation on our own machines is not external proof.
| Component | State | What that means |
|---|---|---|
| Admission control & authority binding | Built · validated locally | Expiry, scope, and path enforcement with passing test suites on our hardware. |
| Receipt spine & offline verifier | Built · published | A signed evidence bundle and a portable verifier are public. Anyone can run them. |
| Bounded execution lifecycle | Built · frozen reference | A complete governed run, hash-bound and reproducible against its own frozen source. |
| Build-room cockpit | Built · non-actuating | Displays authority, evidence, and refusals. Deliberately not wired to live execution. |
| Live agent dispatch | Withheld | The runtime guard's authoritative source has not been commissioned. Not available. |
| Governed component registry | Specified · not built | Designed and catalogued. No implementation claim is made. |
| Independent external validation | Not performed | No third party has audited the system. |
A system whose entire premise is disclosing its own limits has to start with its own. If any of the following is later true, it will be said here in the same size type.
The evidence bundle is public, offline-verifiable, and signed. It contains no proprietary source and no private keys. Clone it, run the verifier, and decide for yourself what it does and doesn't prove.
git clone https://github.com/Anans-AI/anans-containment-proofs cd anans-containment-proofs/proofs/nist-ma12/v0.1.0-audit python -m pip install pynacl python EVIDENCE/VERIFY.py --evidence_dir EVIDENCE # expected: VERIFY PASS
A passing result is bounded. It tells you the recorded run is internally consistent and independently inspectable. It does not tell you who controlled the signing key, whether the harness was complete, or whether every relevant path was tested. Those remain open, and the bundle says so.
Not buyers — there is nothing to buy yet. This is for people evaluating whether AI workers can be allowed near controlled software, and for reviewers willing to break something and say so.
If you run the bundle, the most useful thing you can send back is not whether it passed. It is the list of things you still had to trust after it passed.