An authority layer for agent actions
Write down what your agent may do. Check every action against it.
HANRIA's agent skill reads a mandate you wrote — the clauses that say which operations, targets, counterparties and amounts are allowed, when the mandate expires, and which operations always need a person — and evaluates each proposed action against it before the agent acts. It answers permit, deny or escalate, names the clause it relied on, and appends the decision to a local log that detects later alteration. It runs on your machine and makes no network calls. It does not require, store or transmit a credential — and a credential it recognizes in a request or a mandate is refused rather than used — detection is a heuristic, and refusing one means reading it first.
npx skills add HANRIA-AI/hanria-skillThe control gap
Capability and permission are different questions.
An agent may be able to plan, negotiate, call an API, or prepare a transaction. That does not establish who authorized the action, which limits apply, whether a protected credential should be used, or what evidence should remain afterward.
The failure is rarely a single obviously wrong step. It is authority drift: every individual check passes, and the aggregate still lands outside what anyone authorized. Permission systems are poorly placed to catch that, because each step looks correct in isolation. A mandate is the artifact that makes the aggregate reviewable — it states the shape of the whole delegation, not the legality of one call.
Where this actually stands
What works today, what is in the source, and what is not built.
Stated plainly so you can judge it rather than take it on trust. The middle column is implemented and tested in a private Rust workspace. You cannot verify it from here, and source presence is not acceptance, integration, deployment, durability, or release — it is not released, packaged, or offered for use.
Working today
The agent skill, free and installable now: mandate schema, local evaluation returning permit / deny / escalate with the governing clause, refusal of requests carrying recognizable credential material, fail-closed handling of expired or malformed mandates, and a hash-chained decision log that detects alteration and refuses to append to a broken chain.
Implemented in source
A fail-closed admission path; a closed task lifecycle that refuses any transition not in its table; an append-only event chain that detects broken continuity; epoch-monotonic revocation with no grace window; one-shot nonces that refuse replay; privileged operation classes that cannot proceed without a named human decision; a deterministic digest committing to a whole plan tree. No key material in the crate, enforced by its own tests. 80 tests, 80 passing.
Not built
No signatures, no published record format, no independent verifier, no persistence. No daemon, no CLI, no packaged runtime, no download. No sandboxing or process confinement. No confused-deputy or prompt-injection test suite. No third-party audit, certification, or attestation. No release date.
How the skill works
From a written mandate to a recorded decision.
Write the mandate
You state the purpose in your own words, then the clauses: which operation kinds, verbs, targets and counterparties are permitted, what ceiling applies to an amount, when the mandate expires, and which kinds always require a person regardless of any clause. Only a clause's structured
matchconditions decide whether an action is permitted — the purpose, the notes and a request's justification are prose for whoever reviews this later, so a restriction written there and not as a clause does not restrict. The expiry,requires_humanand the default do apply.The agent describes the action
Before acting, the agent writes a typed description of what it proposes to do. A request names what is to be done, never the means — a request carrying anything credential-shaped is refused rather than cleaned up, so the attempt stays visible.
The action is checked
Clauses are evaluated in order and the first match decides. Anything unmatched takes the mandate default, which is deny or escalate — never permit. When nothing matches, the answer names the clauses that came closest and why they did not, which is usually what you need to see.
The decision is recorded
Each entry carries the digest of the one before it, so altering or removing an entry that has anything after it breaks every digest that follows. Deleting from the end is the exception — a chain cannot detect its own truncation, so the tool keeps a separate head file and tells you when it could not rule truncation out. This is local integrity detection for whoever holds the log, not evidence to a third party.
The honest limit
A skill can advise. Only a runtime can refuse.
A skill is instructions and code loaded into an agent's context, and anything in context can be ignored, overridden, or bypassed — by the agent, by a later instruction, or by a different agent. If an agent disregards a deny, the operation still happens.
Enforcement is possible only where the protected credentials, tools, signing keys or worker processes are reachable exclusively through a component that can refuse. That component is the runtime, and it is not released. Anything telling you that installing a skill grants you enforcement is wrong, and the skill says so in its own text.
What the skill is genuinely for: making the mandate explicit, catching the action that falls outside it before it happens, and leaving a record you can review afterward. That is worth having on its own, and it is the interface the runtime would enforce.
FAQ
Questions a reader or an agent may have.
Is HANRIA an AI model or agent framework?
No. The skill is a local checker, and the planned runtime would complement models and orchestration frameworks by mediating consequential operations rather than replacing either.
What does HANRIA stand for?
Nothing. It is a coined name — not an acronym or abbreviation, and no expansion, derivation, or translation is published or intended.
Does installing the skill make my agent safe?
No. It cannot prevent an action. It makes the intended limits explicit, flags actions outside them, and records decisions. Security still depends on correct design, implementation, integration, infrastructure and operations.
Are the log entries legally binding or independently verified?
No such claim is made. There is no signature, no published format and no verifier, so anyone who can write the file can rebuild it. It is a local integrity check, not an attestation.
Does the skill handle keys, money, or digital assets?
No. It reads a mandate and an action description, neither of which may contain a credential, and writes a log. It holds nothing and moves nothing.
Is the runtime available?
No. It is in development. Architecture, capabilities, integrations, terminology and timing may change.
An authority layer for agent actions.
The skill is free and works today. Can a skill stop an unauthorized action → · What is an agent mandate → · How to write a mandate → · For platform operators and orchestration teams → · Present boundaries →