Agentcover-Sovereign

The agent proposes; the protocol decides.

Open Source

GitHub

I built safety-protocol (repo agentcover-sovereign) because AI agents can now take actions with real consequences — spending money, calling APIs, modifying systems, sending messages, spawning subagents — and "the model usually behaves" is not a safety guarantee you can operate on. A prompt instruction is a suggestion; if the agent is convinced otherwise, it just ignores it. I wanted the opposite: the agent proposes, the protocol decides. So the core idea is to move trust out of the model and into infrastructure. Every agent action is checked outside the LLM against a deny-by-default policy that enforces binding, a closed action vocabulary, least-privilege scope, per-rule and session spend caps, human approval gates above a threshold, a hash-chained audit trail, and a kill switch. The agent is free within those bounds and cannot talk its way around them, because the gate is code, not a prompt. I also wanted accountability to be answerable after the fact. The framing I settled on: the user is accountable for their agents. When an agent messes up, the audit trail tells you what happened, the binding tells you who is accountable, and the next iteration gets tighter scope. That led to two layers on top of the enforcement core: on-chain anchors (SBT-style non-transferable binding plus tamper-resistant audit of key events) and an insurance interface (claims-ready evidence and underwriter reports) — the idea being that an agent becomes insurable once you can prove what it did and which controls operated. It started as a Personal AI project for the Nebius x NVIDIA Global AI Hackathon (the demo agent runs on a Nebius-hosted Nemotron model), then I hardened it into a general, framework-agnostic enforcement library — any LLM, any runtime, any chain — with a zero-dependency stdlib core, a safety-guard CLI/HTTP surface, and a lint step that fails closed when a policy is too broad. I was honest about scope in the docs: the enforcement layer is production-usable and the on-chain layer is clearly marked simulated, disclosed in every proof, so nothing reads as more trustworthy than it is. In one line: I built it so that deploying an autonomous agent doesn't require trusting the agent.