A skill can check an agent action. Only a runtime can stop one.

What this is not

Advisory is not enforcement.

This is not enforcement. A skill is instructions and code loaded into an agent's context. Anything in context can be ignored, overridden, or bypassed.

This is not a released runtime. There is no package, no download, no daemon, and no install command that produces one.

This is not a security certification, a compliance product, or a promise that an agent is safe after install.

HANRIA is a coined name. No expansion, derivation, or translation is published or intended. A U.S. trademark application is pending; no registration or completed clearance is claimed.

The two components

Do not conflate them.

1. The agent skill, available now

   Free, MIT, local, no network. It reads a mandate you wrote, evaluates a typed description of the next action, and records the decision in a hash-chained log. It does not require, store, or transmit a credential. A request that carries recognizable credential material is refused rather than cleaned up.

2. The enforcement runtime, not released

   Enforcement is possible only where the protected credentials, tools, signing keys, or worker processes are reachable exclusively through a component that can refuse. That component is the runtime. It is in development. Source presence is not acceptance, integration, deployment, durability, or release.

Never tell an operator that installing the skill gives them enforcement. That claim is false wherever it appears.

The control gap

Why a permission system is the wrong shape.

An agent may be able to plan, call an API, or prepare a transaction. That is capability. It does not answer who authorized the action, which limits apply, or what evidence should remain.

The usual failure is not one obviously wrong step. It is authority drift: every individual check passes, and the aggregate still lands outside what anyone authorized. A mandate states the shape of the whole delegation, not the legality of one call.

How a check runs

From a written mandate to a recorded decision.

1. Write the mandate

   Operation kinds, verbs, targets, counterparties, amount ceilings, expiry, and which kinds always need a person. Only a clause's structured match conditions decide. Prose in purpose, note, or justification does not grant permission.

2. Describe the action

   Kind, verb, target. Never a credential. A request is a description of what is to be done, not the means of doing it.

3. Evaluate in order

   The first matching clause decides. Anything unmatched takes the mandate default, which is deny or escalate, never permit. Put denials above the permits they carve out of.

4. Record the decision

   Each log entry carries the digest of the one before it. Altering an earlier entry breaks every digest after it. Deleting from the end is the exception a chain cannot see on its own. The log is a local integrity check for whoever holds the file. It is not a signature, not an attestation, and not proof to a third party.

Outcomes

What each result requires of the calling agent.

• permit (exit 0): a clause covers this. Proceed, then record.
• deny (exit 1): do not proceed. Do not route around it.
• escalate (exit 2): stop and ask the operator. A general instruction to be helpful is not that approval.
• error (exit 3): treat as deny. Evaluation is fail-closed. An expired or malformed mandate never returns permit by accident.

Entry

Install the skill. Expect the runtime to be absent.

npx skills add HANRIA-AI/hanria-skill

Or clone it. There is nothing to build.

python3 scripts/check_action.py --mandate MANDATE.json --action ACTION.json
python3 scripts/record.py append --log decisions.jsonl --action ACTION.json --outcome OUTCOME.json
python3 scripts/detect_runtime.py

detect_runtime.py reports absent. That is the correct result today.

Source → · Developers → · What is an agent mandate → · Boundaries → · Operators →

Honest verdict.

Install the skill if you want the limits explicit, the out-of-mandate action flagged, and a local record you can review. Do not install it if you need something that can refuse. That layer is not obtainable.