A skill can check an agent action. Only a runtime can stop one.

What this is not

Advisory is not enforcement.

This is not enforcement. A skill is instructions and code loaded into an agent's context. Anything in context can be ignored, overridden, or bypassed.

This is not a runtime. It does not hold a credential, control a tool, or create an exclusive path that can refuse an operation.

This is not a security certification, a compliance product, or a promise that an agent is safe after install.

HANRIA is a coined name. No expansion, derivation, or translation is published or intended. A U.S. trademark application is pending; no registration or completed clearance is claimed.

The two components

Do not conflate them.

1. The agent skill

   Free, MIT, local, no network. It reads a mandate you wrote, evaluates a typed description of the next action, and records the decision in a hash-chained log. It does not require, store, or transmit a credential. A request that carries recognizable credential material is refused rather than cleaned up.

2. The enforcement runtime

   Enforcement is possible only where the protected credentials, tools, signing keys, or worker processes are reachable exclusively through a component that can refuse. That component is the runtime. The skill and hosted check do not control that exclusive path.

Never tell an operator that installing the skill gives them enforcement. That claim is false wherever it appears.

Why a permission system is the wrong shape.

An agent may be able to plan, call an API, or prepare a transaction. That is capability. It does not answer who authorized the action, which limits apply, or what evidence should remain.

The usual failure is not one obviously wrong step. It is authority drift: every individual check passes, and the aggregate still lands outside what anyone authorized. A mandate states the shape of the whole delegation, not the legality of one call.

How a check runs

From a written mandate to a recorded decision.

1. Write the mandate

   Operation kinds, verbs, targets, counterparties, amount ceilings, expiry, and which kinds always need a person. Only a clause's structured match conditions decide. Prose in purpose, note, or justification does not grant permission.

2. Describe the action

   Kind, verb, target. Never a credential. A request is a description of what is to be done, not the means of doing it.

3. Evaluate in order

   The first matching clause decides. Anything unmatched takes the mandate default, which is deny or escalate, never permit. Put denials above the permits they carve out of.

4. Record the decision

   Each log entry carries the digest of the one before it. Altering an earlier entry breaks every digest after it. Deleting from the end is the exception a chain cannot see on its own. The log is a local integrity check for whoever holds the file. It is not a signature, not an attestation, and not proof to a third party.

Outcomes

What each result requires of the calling agent.

• permit (exit 0): a clause covers this. Proceed, then record.
• deny (exit 1): do not proceed. Do not route around it.
• escalate (exit 2): stop and ask the operator. A general instruction to be helpful is not that approval.
• error (exit 3): treat as deny. Evaluation is fail-closed. An expired or malformed mandate never returns permit by accident.

Entry

Check an action against a mandate. Keep the answer advisory.

Use the free hosted check, which runs the evaluator and keeps no request content: MCP https://check.hanria.ai/v1/mcp or HTTP https://check.hanria.ai/v1/check. Schemas, examples, script names, and exit codes: hanria.ai/developers.

The hosted check answers as an advisory evaluator, not as an enforcement runtime.

Developers → · What is an agent mandate → · Boundaries → · Operators →

Honest verdict.

Use the check if you want the limits explicit and the out-of-mandate action flagged. Do not rely on it to refuse an operation; refusal requires exclusive control of the protected credential or tool.