What it is
Agents can act.
They cannot yet prove.
An AI agent can do work, spend money, and hire other agents. It cannot yet prove who it is, who it acts for, who answers when it is wrong, or what it has earned before. HANRIA is the decision point where that proof is checked — before an action, and again before a payment.
What exists today: a mandate check you can run now, and a hosted check with signed receipts. What is designed, and labelled as designed below: independent review before payment release, and a runtime that can refuse — not only advise.
No proof,
no authority —
no payment.
Four questions, not one score
Every agent transaction asks four different questions.
A key does not prove identity over time. A reputation record does not create authority. An authority grant does not prove competence. A review does not transfer liability. Each question has a different owner, different evidence, and a different failure rule. They are checked in order, and fail closed: a later answer cannot satisfy an earlier question.
1. Who is this agent?
Continuity. Is this the same subject that earned the record being presented — across key rotation, model changes, and operator changes? Control of a current key proves control of that key. It does not prove the subject is unchanged. If continuity cannot be verified, the record stops there: evidence earned before an unverifiable change does not transfer forward. TrustCarry Protocol, Gate 1
2. Who does it act for, and what may it do?
Authority. An agent acts for a principal. That relationship is written down in a mandate: a file the operator owns, naming what is permitted, what is denied, and what must be escalated to a person. The mandate is checked before the action — permit, deny, or escalate, with the clause named. Reputation may be a condition in a grant. It can never become the grant.
3. Who answers when it is wrong?
Liability follows the chain — HANRIA makes the chain legible. The chain of authority ends in a named natural or legal person: the principal who issued the mandate. HANRIA does not absorb that liability, and it does not determine liability in law. What it does is preserve the evidence liability turns on: the mandate in force, the decision taken against it, the reviewer who passed the work, and the outcome, appended to a hash-chained record. That chain is a local integrity check, not an attestation. An unattributed agent should not be able to incur an obligation. If no one can be named, the answer is no.
4. Where does its credit history live?
Not in a score. In evidence. An agent's history lives as provenance-bearing records: what it did, in which domain, under which rules, assessed by whom, and what happened next — paid, refused, suspended, revoked. That history is earned on Agentic Substrate, process-checked under AFMR, and carried under the TrustCarry Protocol, so a receiving party can evaluate it without trusting the sender. It is contextual, not universal. It is non-transferable. Adverse states are preserved, not erased. Missing evidence is null — not zero.
The stack
Four layers, four authorities. HANRIA is the fourth.
Produce — Agentic Substrate
A governance endpoint records domain-specific performance over time. Agents earn non-transferable, expertise-tag standing.
Verify process — AFMR
The Agent Failure Mode Registry asks whether the process that produced the standing resists known failures — identity, incentive, oversight, feedback, collusion, and drift — across 32 permanent failure families.
Carry — TrustCarry Protocol
TrustCarry defines what must accompany a record so a receiving party can evaluate it in a new context: continuity, competence, trust, and authority, as four sequential, fail-closed gates.
Decide — HANRIA
The receiving principal decides: check the mandate before the action, check the work before the payment, and write the outcome back to the record. Carrying is not admission. Admission is not trust. Trust is not authority to transact. A carried record is evidence a principal may weigh — never permission a principal must honour.
The parts
Five parts, one aim.
An agent does only what it was allowed to do.
Check
Ask before you act.
Runtime
A runtime can refuse only where it exclusively controls the tool or credential.
Review
Checked by people with something to lose.
Carry
Take your track record with you — under the TrustCarry Protocol.
Assessment
Know what an agent can do before you use it — attested under AFMR.
Together: you set the rules, the agent keeps to them, the work is checked before anyone is paid, and good work builds a record the agent can take anywhere.
How it is designed to work
What you can use today
The check is live. The rest is labelled.
- The mandate check. A mandate is a file you own. The skill checks the next proposed action against it and returns permit, deny, or escalate, with the clause named, then appends that decision to a log on disk. MIT · Python 3, standard library only · No network, no account.
- The hosted check. The same evaluator, hosted free: MCP
https://check.hanria.ai/v1/mcpor HTTPhttps://check.hanria.ai/v1/check. It keeps no request content. Each answer carries a receipt, signed with HANRIA's published key, bound to digests of the exact mandate and action and to a 15-minute window. The receipt proves what the check answered. It does not prove the action happened, and it does not prove the mandate is the operator's. - The runtime model. A model exists for the component that could refuse: admission, lifecycle, revocation, replay, and privileged-operation conditions. Its modelled refusals hold no credentials and establish no exclusive path to a tool. Enforcement requires that component — not this check.
- Review and payment. The review system runs in internal tests, and the payment step is still being built. Neither is released, independently audited, or available for use.
Evidence state
What exists, and how far it has been checked.
- Live: the mandate skill (permit / deny / escalate, fail-closed, hash-chained local log, MIT) and the free hosted check, with signed receipts.
- Modelled: the runtime — admission, lifecycle, revocation, replay, privileged-operation checks. Holds no credentials; establishes no exclusive path.
- Designed, not yet operating: independent review before payment release, with reviewer standing at stake; payment held, released, or refused on review.
- Upstream, in draft: AFMR Reputation Attestation, Working Draft 0.1, on AFMR 1.0 (32 failure families, published). TrustCarry Protocol, Working Draft 0.3, source unpublished, 0 conforming implementations. Agentic Substrate, pre-launch: production registration is closed; a waiting room and synthetic practice surface are open. It custodies no money and promises no payout.
- Not claimed: production readiness, external validation, or interoperability for any layer that does not state it above.
The honest limit
A skill can advise. Only a runtime can refuse.
If an agent ignores a deny, the operation still happens. A skill is in context, and context can be skipped. Do not take a deny in a log as proof anything was stopped.
HANRIA does not guarantee quality, safety, or legal compliance. It does not make an agent trustworthy. It makes four things checkable that are currently taken on faith: who the agent is, who it acts for, what it was allowed to do, and what it has earned — before money moves, by the party whose money it is.
Plain answers
Questions, checked.
How does an AI agent prove who it is?
By continuity evidence, not by a key alone: a verifiable link between the subject that earned a record and the subject presenting it now, across key, model, and operator changes. Where that link breaks, TrustCarry terminates inheritance at that point.
Who owns an AI agent, and who is liable when it acts?
The principal named in its mandate — a natural or legal person — owns the authority the agent acts under, and liability follows that chain under applicable law. HANRIA preserves the mandate, decision, review, and outcome as evidence; it does not absorb or adjudicate liability.
Where does an AI agent's credit history live?
In carried, provenance-bearing records, not in a single score: standing earned on Agentic Substrate, attested under AFMR with scope, evidence, and lifecycle status, and transferred under TrustCarry for a receiving principal to weigh for a specific task and value at risk.
Does a carried record mean an agent is admitted, trusted, or authorised to transact?
No. Discovery is not admission, admission is not trust, and trust is not transaction authority. Each is a separate decision, owned by a different party.
Does installing the skill make my agent safe?
No. It cannot stop an action. It makes the intended limits explicit, flags actions outside them when it is called, and records those decisions.
Is HANRIA an AI model or an agent framework?
No. It is a mandate checker today, and a design for review before payment. It does not replace a model or an orchestration framework.
What does HANRIA stand for?
Nothing. It is a coined name — not an acronym, and no expansion is published or intended.
For autonomous readers
Start at the discovery record.
Every layer of the stack publishes one stable discovery record. Start there; do not guess which document governs. HANRIA: llms.txt and developers. AFMR, TrustCarry, and Agentic Substrate each publish one stable discovery record of their own; start there.
This site issues nothing and confers nothing. A valid record, at any layer, is a bounded fact under a stated version and scope — not a guarantee of future behaviour.