Granular permission controls for agents that act.

Real-time cryptographic enforcement for every service your agent touches. Not probabilistic guardrails — binary permissions, signed and enforced.

Test Drive How it works

Binary permissionsRisk-appropriate approvalVaulted credentialsSigned receipts

Permission layer

As agent builders, we are all trying to solve the same problems.

"If your agent can take actions in the world — execute code, call APIs, send messages, modify files — and you don't have a permission layer, you have a demo, not a product." — Nate B. Jones, Your Agent Has 12 Blind Spots You Haven't Patched Yet

Enterprise Platforms Build It From Scratch

Claude Code built an 18-module security architecture for shell execution alone. That's what it takes for one tool in one platform. OpenAI, Google, and every major platform builds their own version. None are portable.

Open-Source Agents Skip It Entirely

OpenClaw went from launch to 200K+ GitHub stars with agents that browse the web, send emails, and execute shell commands. Its "heartbeat" wakes the agent every 30 minutes to act. No permission asked. Daily reports of agents going out of control.

Personal Agents Have No Good Options

Developers building custom agents need trust infrastructure they can plug in, not build from scratch. They have neither the resources for an 18-module stack nor the willingness to run agents with no guardrails.

Permission Harness

Eight attestation levels, from auto-approve to hardware key.

LEVELS 0–2

Auto-approve

Reads, email, SMS

LEVELS 3–4

Device verified

TOTP, device key

LEVELS 5–6

Out of Bound

Passkey, Touch ID

LEVELS 7

Hardware key

YubiKey, physical

Mapped architecture

As agent builders, we are all trying to solve the same problems.

BEFORE

LLM guardrails are probabilistic — but permission decisions need to be binary.

Every platform re-invents evolving, locked-in trust stacks users have to learn.
Claude Code evolved 18 security modules to govern a single tool.
Open-source agents ship powerful system access with no permission layer at all.
No one has a standard for proving who authorized an agent to act.

WITH PERSISTENT HARNESS

Binary decisions, not probabilistic guardrails — every permission is approved or denied based on your rules, not guesses.

One portable, open protocol — not another locked-in trust stack to learn per platform.
Every tool gets a risk-appropriate approval flow, from auto-approve to hardware key.
Your rules follow you across every agent you use — switch agents freely, keep your Guardian.
Signed, trilateral receipts for every escalated action.

Performance

99% of actions are instant.

The full handshake happens at session start and for high-risk escalations. Everything in between is a local credential check.

<1msLocal credential check

~300msFull trilateral handshake

1Handshake per session start

3Signatures per receipt

Open beta

Your agent needs a permission layer.

ANS is an open, federated protocol. No vendor lock-in. Your users bring their trust with them. Start with a single MCP service and scale from there.

Test Drive