AFA PROTOCOL 02 Join beta Coming soon

Product 02 Control for tool-using AI agents

Let agents do more useful work.
Keep people in control.

On a supported, connected host, AFA helps your team decide what an AI agent may do before it uses a tool. It can pause risky steps for human approval and keep a signed record of what happened and in what order.

See how the check works Hosted access status
  • Keep control closeCore authority stays with the operator.
  • Keep content privateThe record keeps digests and structure, not raw prompts.
  • Cryptographic accountabilitySignatures and order checks help show what happened when.
Live model / bounded expansion
Authority tree expanding from one to seven agents A human root delegates to scoped agents. Additional branches appear while the authority boundary remains fixed. H GATE A1 A2 A3 T1 T2 T3 X DECLARED AUTHORITY BOUNDARY OUT OF SCOPE
Active agents3
Authority boundaryFixed
Out-of-scope pathBlocked
01 / The value

More agent work does not have to mean unlimited access.

AFA is designed to help teams run longer tasks, control spending, coordinate more agents, and review what happened afterward. Each agent can have a clear limit, stop point, and human owner. These are practical examples, not measured gains. We have not measured a capacity multiplier.

01 / Time

Let work run with clear stop points

A scheduled agent can have an end time, review points, and a way to revoke access instead of receiving permanent permission. We have not yet measured how much longer work can run.

02 / Money

Pause spending before it happens

On a supported host, a rule can require human approval before paid model use, cloud provisioning, or a DNS change. Hosted metering is not live, and AFA has not measured token or cost savings.

03 / Operations

Use several agents without losing responsibility

AFA can show which child agent started under which parent while research, build, and review happen in parallel. Full per-child path and call-budget enforcement is still an open gate.

04 / Evidence

Review the handoffs later

Signed summaries of calls and results can preserve the order of work across agents. They help with review, but they do not prove that an action was accurate, true, or wise.

02 / The authority loop

Check before the tool runs.
Keep a record after.

A normal log tells you what already happened. AFA is designed to add a decision before a supported action, then keep a receipt afterward.

I S G A R
Intent envelope The request gets a named actor and boundary.

Before a tool is reached, the work has an explicit purpose, time horizon, and parent.

03 / Delegation

Split the work.
Keep the limits.
Bring it back for review.

When several agents work at once, AFA helps preserve who started each branch, what it was allowed to reach, and where a person must step in.

Scoped delegation branches and a human merge gate A root instruction branches to research, build, and review. An out-of-scope network action is denied before the approved branches merge. HUMAN INTENTsigned root SCOPEsplit RESEARCHread only BUILDworkspace write NETWORKnot granted HUMANmerge gate RECEIPTordered
ExpansionMore branches, not more ambiguity.InterventionThe denied path remains visible.
04 / The drift envelope

Keep the job around
the work.

AFA wraps a task in a signed envelope: owner, purpose digest, scope, action class, time mode, and parent. As work branches, envelope changes can be compared. On a supported host, an explicit boundary crossing can pause or stop before the tool runs.

01 / AnchorOwner + purpose digest
02 / BoundScope + time + parent
03 / CompareEnvelope delta + policy
04 / InterruptAllow + ask + deny

AFA surfaces structural drift. It does not infer intent from private reasoning, and broad limits still permit broad behavior.

Authority trace / demonstrationLIVE
  1. intentowner + purpose boundsha256:7c1d...a8
  2. delegationchild envelope linkedsha256:883e...19
  3. envelope_deltanetwork scope addedsha256:0ad4...72
RETAINED event class / parent / decision / digest / signature NOT RETAINED prompt / source / secret / chain of thought
05 / MCP + API

Two ways to connect.
The same control model.

MCP connects AFA checks and records to compatible agent hosts. The hosted API will support teams working across machines after its storage, usage counting, notifications, and enforcement checks are ready.

01 / Connect a host

MCP

Bring AFA action checks and signed records into a compatible agent host through a small, inspectable tool connection.

Integration surface
02 / Work across machines

Hosted API

Team identity, shared rules, durable usage records, notifications, and review exports are still gated for launch.

Why this is coming later

Special cases. SDKs and portable .authority bundles support specific integrations and evidence handoffs. They are implementation artifacts, not separate primary product surfaces.

06 / Cryptographic accountability

See what changed.
See what came first.

AFA signs the envelope and preserves event order. That helps expose changed records, expanded scope, and approval added after an action. For disputed work, the same record can support chronology and custody; it does not decide who owns the work.

AFA HELPS WITH
  • Checking supported actions before they run
  • Comparing a child envelope with its parent
  • Pausing actions outside configured scope
  • Preserving signed chronology and content digests
AFA DOES NOT
  • Replace operating-system permissions or a sandbox
  • Infer intent from private reasoning
  • Store raw prompts, source code, or secrets
  • Decide authorship, ownership, originality, or truth

Current foundation: SHA-256 digests and Ed25519 signatures. Integrity is not truth. Governance is not a sandbox.

Read the security and privacy model

Hosted surface Coming soon

The account and API layer ships when its controls are real.

Identity, durable metering, notification delivery, and resource-side enforcement must clear release gates together. A dashboard ahead of those controls would be theater.

Request a launch note Read the launch rationale